Security: Fixes for CVE-2022-31107 and CVE-2022-31097 (#52279)

* WIP: Fix XSS in runbook URL (#378)

(cherry picked from commit f4a8d96a4e1259ea25d9cc702a652f1b819db236)
(cherry picked from commit 337c08507b2b1c78ea470192d34cf611fae4b5da)
(cherry picked from commit 54b36a07406ed4e26ff8e161e50eda5401f504da)

* Update grabpl version

(cherry picked from commit b253e87d730f7b8aabdd0b328c5e7a82547c43b3)
(cherry picked from commit 080d3e46f3fcd61555795b9fe8fd6ee2492b422a)

* Fix: Choose Lookup params per auth module

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: Prefer pointer to struct in lookup

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: user email for ldap

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: Use only login for lookup in LDAP

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: use user email for ldap

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

fix remaining test

fix nit picks

(cherry picked from commit 1eca4aeed878853743cebcf9790b05dd350c4f83)
(cherry picked from commit 0777d100e9263d08f51dbac71aee0766c8a85a92)

* remove better (broke the pipeline)

Co-authored-by: George Robinson <george.robinson@grafana.com>
Co-authored-by: dsotirakis <sotirakis.dim@gmail.com>
Co-authored-by: jguer <joao.guerreiro@grafana.com>

This commit is contained in:

Kevin Minehart

2022-07-14 14:56:53 -05:00

committed by

GitHub

co-authored by

George Robinson

dsotirakis

jguer

parent 1d6190e4ff

commit 4665dc253f

17 changed files with 148 additions and 89 deletions

									
										pkg/api/ldap_debug.go
									
		+5
		
												View File
												
				@@ -220,6 +220,11 @@ func (hs *HTTPServer) PostSyncUserWithLDAP(c *models.ReqContext) response.Respon

						ReqContext:    c,

						ExternalUser:  user,

						SignupAllowed: hs.Cfg.LDAPAllowSignup,

						UserLookupParams: models.UserLookupParams{

							UserID: &query.Result.Id, // Upsert by ID only

							Email:  nil,

							Login:  nil,

						},

					}

					err = hs.Login.UpsertUser(c.Req.Context(), upsertCmd)