From 7010df0fe804ded726375752281adc6f45110bed Mon Sep 17 00:00:00 2001 From: Anthony Woods Date: Sat, 21 Mar 2015 07:14:13 +0800 Subject: [PATCH 01/12] fixes #1619 Secure PhantomJS Png rendering removes auth hack to allow phantomjs to query pages as a user without auth. Instead we pass phantomjs the session cookie, which it then includes in the request. --- pkg/api/render.go | 9 +++++---- pkg/components/renderer/renderer.go | 11 +++++++---- pkg/middleware/auth.go | 7 ------- vendor/phantomjs/render.js | 10 ++++++++-- 4 files changed, 20 insertions(+), 17 deletions(-) diff --git a/pkg/api/render.go b/pkg/api/render.go index 8649dfe4c6b..0398d455cc8 100644 --- a/pkg/api/render.go +++ b/pkg/api/render.go @@ -12,12 +12,13 @@ import ( func RenderToPng(c *middleware.Context) { queryReader := util.NewUrlQueryReader(c.Req.URL) - queryParams := fmt.Sprintf("?render=1&%s=%d&%s", middleware.SESS_KEY_USERID, c.UserId, c.Req.URL.RawQuery) + queryParams := fmt.Sprintf("?%s", c.Req.URL.RawQuery) renderOpts := &renderer.RenderOpts{ - Url: c.Params("*") + queryParams, - Width: queryReader.Get("width", "800"), - Height: queryReader.Get("height", "400"), + Url: c.Params("*") + queryParams, + Width: queryReader.Get("width", "800"), + Height: queryReader.Get("height", "400"), + SessionId: c.Session.ID(), } renderOpts.Url = setting.ToAbsUrl(renderOpts.Url) diff --git a/pkg/components/renderer/renderer.go b/pkg/components/renderer/renderer.go index cd8979a57bc..054632395ce 100644 --- a/pkg/components/renderer/renderer.go +++ b/pkg/components/renderer/renderer.go @@ -14,9 +14,10 @@ import ( ) type RenderOpts struct { - Url string - Width string - Height string + Url string + Width string + Height string + SessionId string } func RenderToPng(params *RenderOpts) (string, error) { @@ -26,7 +27,9 @@ func RenderToPng(params *RenderOpts) (string, error) { pngPath, _ := filepath.Abs(filepath.Join(setting.ImagesDir, getHash(params.Url))) pngPath = pngPath + ".png" - cmd := exec.Command(binPath, scriptPath, "url="+params.Url, "width="+params.Width, "height="+params.Height, "png="+pngPath) + cmd := exec.Command(binPath, scriptPath, "url="+params.Url, "width="+params.Width, + "height="+params.Height, "png="+pngPath, "cookiename="+setting.SessionOptions.CookieName, + "domain="+setting.Domain, "sessionid="+params.SessionId) stdout, err := cmd.StdoutPipe() if err != nil { diff --git a/pkg/middleware/auth.go b/pkg/middleware/auth.go index 7c8f8f30087..53b554942a6 100644 --- a/pkg/middleware/auth.go +++ b/pkg/middleware/auth.go @@ -22,13 +22,6 @@ func getRequestUserId(c *Context) int64 { return userId.(int64) } - // TODO: figure out a way to secure this - if c.Req.URL.Query().Get("render") == "1" { - userId := c.QueryInt64(SESS_KEY_USERID) - c.Session.Set(SESS_KEY_USERID, userId) - return userId - } - return 0 } diff --git a/vendor/phantomjs/render.js b/vendor/phantomjs/render.js index b8f91e1c73b..58afcd44eba 100644 --- a/vendor/phantomjs/render.js +++ b/vendor/phantomjs/render.js @@ -9,13 +9,19 @@ args.forEach(function(arg) { params[parts[1]] = parts[2]; }); -var usage = "url= png= width= height="; +var usage = "url= png= width= height= cookiename= sessionid= domain="; -if (!params.url || !params.png) { +if (!params.url || !params.png || !params.cookiename || ! params.sessionid || !params.domain) { console.log(usage); phantom.exit(); } +phantom.addCookie({ + 'name': params.cookiename, + 'value': params.sessionid, + 'domain': params.domain +}); + page.viewportSize = { width: params.width || '800', height: params.height || '400' From 245c6dbff00aa71fd778270db3f2d3a7b2cf8e65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torkel=20=C3=96degaard?= Date: Fri, 20 Mar 2015 22:01:39 -0400 Subject: [PATCH 02/12] Share Panel: The share modal now has an embed option, gives you an iframe that you can use to embedd a single graph on another web site, #1622 --- CHANGELOG.md | 1 + .../features/dashboard/dashboardNavCtrl.js | 2 +- .../dashboard/partials/shareDashboard.html | 48 ++++++++++++++ .../dashboard/partials/shareModal.html | 53 --------------- .../dashboard/partials/sharePanel.html | 65 +++++++++++++++++++ src/app/features/dashboard/sharePanelCtrl.js | 5 +- src/app/features/panel/panelSrv.js | 2 +- src/app/features/panel/soloPanelCtrl.js | 16 ++++- src/css/less/forms.less | 6 ++ src/test/specs/soloPanelCtrl-specs.js | 6 ++ 10 files changed, 146 insertions(+), 58 deletions(-) create mode 100644 src/app/features/dashboard/partials/shareDashboard.html delete mode 100644 src/app/features/dashboard/partials/shareModal.html create mode 100644 src/app/features/dashboard/partials/sharePanel.html diff --git a/CHANGELOG.md b/CHANGELOG.md index eb1ffcdecb9..15e1527ad8c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # 2.0.0 (unreleased) **New features** +- [Issue #1622](https://github.com/grafana/grafana/issues/1622). Share Panel: The share modal now has an embed option, gives you an iframe that you can use to embedd a single graph on another web site - [Issue #718](https://github.com/grafana/grafana/issues/718). Dashboard: When saving a dashboard and another user has made changes inbetween the user is promted with a warning if he really wants to overwrite the other's changes - [Issue #1331](https://github.com/grafana/grafana/issues/1331). Graph & Singlestat: New axis/unit format selector and more units (kbytes, Joule, Watt, eV), and new design for graph axis & grid tab and single stat options tab views - [Issue #1241](https://github.com/grafana/grafana/issues/1242). Timepicker: New option in timepicker (under dashboard settings), to change ``now`` to be for example ``now-1m``, usefull when you want to ignore last minute because it contains incomplete data diff --git a/src/app/features/dashboard/dashboardNavCtrl.js b/src/app/features/dashboard/dashboardNavCtrl.js index a47e19b561f..5950c504a3a 100644 --- a/src/app/features/dashboard/dashboardNavCtrl.js +++ b/src/app/features/dashboard/dashboardNavCtrl.js @@ -42,7 +42,7 @@ function (angular, _, moment) { $scope.shareDashboard = function() { $scope.appEvent('show-modal', { - src: './app/features/dashboard/partials/shareModal.html', + src: './app/features/dashboard/partials/shareDashboard.html', scope: $scope.$new(), }); }; diff --git a/src/app/features/dashboard/partials/shareDashboard.html b/src/app/features/dashboard/partials/shareDashboard.html new file mode 100644 index 00000000000..e052c5b298f --- /dev/null +++ b/src/app/features/dashboard/partials/shareDashboard.html @@ -0,0 +1,48 @@ + diff --git a/src/app/features/dashboard/partials/shareModal.html b/src/app/features/dashboard/partials/shareModal.html deleted file mode 100644 index a9707be94b1..00000000000 --- a/src/app/features/dashboard/partials/shareModal.html +++ /dev/null @@ -1,53 +0,0 @@ -