Profile: Fixes profile preferences being accessible when anonymous access was enabled (#31516)

* Profile: Fixes profile preferences page being available when anonymous access was enabled

* Minor change

* Renamed property

pkg/api/api.go

@@ -19,6 +19,7 @@ var plog = log.New("api")
 // registerRoutes registers all API HTTP routes.
 func (hs *HTTPServer) registerRoutes() {
 	reqSignedIn := middleware.ReqSignedIn
+	reqSignedInNoAnonymous := middleware.ReqSignedInNoAnonymous
 	reqGrafanaAdmin := middleware.ReqGrafanaAdmin
 	reqEditorRole := middleware.ReqEditorRole
 	reqOrgAdmin := middleware.ReqOrgAdmin
@@ -41,10 +42,10 @@ func (hs *HTTPServer) registerRoutes() {
 
 	// authed views
 	r.Get("/", reqSignedIn, hs.Index)
-	r.Get("/profile/", reqSignedIn, hs.Index)
-	r.Get("/profile/password", reqSignedIn, hs.Index)
+	r.Get("/profile/", reqSignedInNoAnonymous, hs.Index)
+	r.Get("/profile/password", reqSignedInNoAnonymous, hs.Index)
 	r.Get("/.well-known/change-password", redirectToChangePassword)
-	r.Get("/profile/switch-org/:id", reqSignedIn, hs.ChangeActiveOrgAndRedirectToHome)
+	r.Get("/profile/switch-org/:id", reqSignedInNoAnonymous, hs.ChangeActiveOrgAndRedirectToHome)
 	r.Get("/org/", reqOrgAdmin, hs.Index)
 	r.Get("/org/new", reqGrafanaAdmin, hs.Index)
 	r.Get("/datasources/", reqOrgAdmin, hs.Index)
@@ -147,7 +148,7 @@ func (hs *HTTPServer) registerRoutes() {
 
 			userRoute.Get("/auth-tokens", routing.Wrap(hs.GetUserAuthTokens))
 			userRoute.Post("/revoke-auth-token", bind(models.RevokeAuthTokenCmd{}), routing.Wrap(hs.RevokeUserAuthToken))
-		})
+		}, reqSignedInNoAnonymous)
 
 		// users (admin permission required)
 		apiRoute.Group("/users", func(usersRoute routing.RouteRegister) {

pkg/api/stars.go

@@ -7,10 +7,6 @@ import (
 )
 
 func StarDashboard(c *models.ReqContext) response.Response {
-	if !c.IsSignedIn {
-		return response.Error(412, "You need to sign in to star dashboards", nil)
-	}
-
 	cmd := models.StarDashboardCommand{UserId: c.UserId, DashboardId: c.ParamsInt64(":id")}
 
 	if cmd.DashboardId <= 0 {

pkg/middleware/auth.go

@@ -16,6 +16,7 @@ import (
 type AuthOptions struct {
 	ReqGrafanaAdmin bool
 	ReqSignedIn     bool
+	ReqNoAnonynmous bool
 }
 
 func accessForbidden(c *models.ReqContext) {
@@ -75,6 +76,7 @@ func RoleAuth(roles ...models.RoleType) macaron.Handler {
 func Auth(options *AuthOptions) macaron.Handler {
 	return func(c *models.ReqContext) {
 		forceLogin := false
+
 		if c.AllowAnonymous {
 			forceLoginParam, err := strconv.ParseBool(c.Req.URL.Query().Get("forceLogin"))
 			if err == nil {
@@ -89,7 +91,9 @@ func Auth(options *AuthOptions) macaron.Handler {
 				}
 			}
 		}
-		requireLogin := !c.AllowAnonymous || forceLogin
+
+		requireLogin := !c.AllowAnonymous || forceLogin || options.ReqNoAnonynmous
+
 		if !c.IsSignedIn && options.ReqSignedIn && requireLogin {
 			notAuthorized(c)
 			return

pkg/middleware/auth_test.go

@@ -38,6 +38,19 @@ func TestMiddlewareAuth(t *testing.T) {
 			cfg.AnonymousOrgName = "test"
 		}
 
+		middlewareScenario(t, "ReqSignIn true and NoAnonynmous true", func(
+			t *testing.T, sc *scenarioContext) {
+			bus.AddHandler("test", func(query *models.GetOrgByNameQuery) error {
+				query.Result = &models.Org{Id: orgID, Name: "test"}
+				return nil
+			})
+
+			sc.m.Get("/api/secure", ReqSignedInNoAnonymous, sc.defaultHandler)
+			sc.fakeReq("GET", "/api/secure").exec()
+
+			assert.Equal(t, 401, sc.resp.Code)
+		}, configure)
+
 		middlewareScenario(t, "ReqSignIn true and request with forceLogin in query string", func(
 			t *testing.T, sc *scenarioContext) {
 			bus.AddHandler("test", func(query *models.GetOrgByNameQuery) error {

pkg/middleware/middleware.go

@@ -15,9 +15,10 @@ var (
 		ReqSignedIn:     true,
 		ReqGrafanaAdmin: true,
 	})
-	ReqSignedIn   = Auth(&AuthOptions{ReqSignedIn: true})
-	ReqEditorRole = RoleAuth(models.ROLE_EDITOR, models.ROLE_ADMIN)
-	ReqOrgAdmin   = RoleAuth(models.ROLE_ADMIN)
+	ReqSignedIn            = Auth(&AuthOptions{ReqSignedIn: true})
+	ReqSignedInNoAnonymous = Auth(&AuthOptions{ReqSignedIn: true, ReqNoAnonynmous: true})
+	ReqEditorRole          = RoleAuth(models.ROLE_EDITOR, models.ROLE_ADMIN)
+	ReqOrgAdmin            = RoleAuth(models.ROLE_ADMIN)
 )
 
 func HandleNoCacheHeader(ctx *models.ReqContext) {