From 68cdbb611f0c0187f9a55f4f6f4a28a8e0047393 Mon Sep 17 00:00:00 2001 From: Emil Tullstedt Date: Tue, 11 May 2021 20:04:29 +0200 Subject: [PATCH] Access control: Use global scope for users permissions (#33941) Quick fix. We eventually will want to make users endpoints more aware of the access control system. --- pkg/api/api.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/api/api.go b/pkg/api/api.go index fd4c869cfad..8524fb49cde 100644 --- a/pkg/api/api.go +++ b/pkg/api/api.go @@ -160,7 +160,7 @@ func (hs *HTTPServer) registerRoutes() { // users (admin permission required) apiRoute.Group("/users", func(usersRoute routing.RouteRegister) { - const userIDScope = `users:{{ index . ":id" }}` + const userIDScope = `global:users:{{ index . ":id" }}` usersRoute.Get("/", authorize(reqGrafanaAdmin, accesscontrol.ActionUsersRead, accesscontrol.ScopeGlobalUsersAll), routing.Wrap(SearchUsers)) usersRoute.Get("/search", authorize(reqGrafanaAdmin, accesscontrol.ActionUsersRead, accesscontrol.ScopeGlobalUsersAll), routing.Wrap(SearchUsersWithPaging)) usersRoute.Get("/:id", authorize(reqGrafanaAdmin, accesscontrol.ActionUsersRead, userIDScope), routing.Wrap(GetUserByID))