From 702fc3477d555af396a6242fa3675c9406d7cf60 Mon Sep 17 00:00:00 2001 From: Ieva Date: Wed, 31 Jul 2024 09:49:09 +0100 Subject: [PATCH] RBAC: Fix folder move check when action sets are disabled (#91200) fox folder move check when action sets are disabled --- pkg/services/folder/folderimpl/folder.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/services/folder/folderimpl/folder.go b/pkg/services/folder/folderimpl/folder.go index fa30e3bcd99..23e6ca82875 100644 --- a/pkg/services/folder/folderimpl/folder.go +++ b/pkg/services/folder/folderimpl/folder.go @@ -978,6 +978,12 @@ func (s *Service) canMove(ctx context.Context, cmd *folder.MoveFolderCommand) (b var evaluators []accesscontrol.Evaluator currentFolderScope := dashboards.ScopeFoldersProvider.GetResourceScopeUID(cmd.UID) for action, scopes := range permissions { + // Skip unexpanded action sets - they have no impact if action sets are not enabled + if !s.features.IsEnabled(ctx, featuremgmt.FlagAccessActionSets) { + if action == "folders:view" || action == "folders:edit" || action == "folders:admin" { + continue + } + } for _, scope := range newFolderAndParentUIDs { if slices.Contains(scopes, scope) { evaluators = append(evaluators, accesscontrol.EvalPermission(action, currentFolderScope))