Profile: Fixes profile preferences being accessible when anonymous access was enabled (#31516)

* Profile: Fixes profile preferences page being available when anonymous access was enabled

* Minor change

* Renamed property

pkg/middleware/auth.go

@@ -16,6 +16,7 @@ import (
 type AuthOptions struct {
 	ReqGrafanaAdmin bool
 	ReqSignedIn     bool
+	ReqNoAnonynmous bool
 }
 
 func accessForbidden(c *models.ReqContext) {
@@ -75,6 +76,7 @@ func RoleAuth(roles ...models.RoleType) macaron.Handler {
 func Auth(options *AuthOptions) macaron.Handler {
 	return func(c *models.ReqContext) {
 		forceLogin := false
+
 		if c.AllowAnonymous {
 			forceLoginParam, err := strconv.ParseBool(c.Req.URL.Query().Get("forceLogin"))
 			if err == nil {
@@ -89,7 +91,9 @@ func Auth(options *AuthOptions) macaron.Handler {
 				}
 			}
 		}
-		requireLogin := !c.AllowAnonymous || forceLogin
+
+		requireLogin := !c.AllowAnonymous || forceLogin || options.ReqNoAnonynmous
+
 		if !c.IsSignedIn && options.ReqSignedIn && requireLogin {
 			notAuthorized(c)
 			return

pkg/middleware/auth_test.go

@@ -38,6 +38,19 @@ func TestMiddlewareAuth(t *testing.T) {
 			cfg.AnonymousOrgName = "test"
 		}
 
+		middlewareScenario(t, "ReqSignIn true and NoAnonynmous true", func(
+			t *testing.T, sc *scenarioContext) {
+			bus.AddHandler("test", func(query *models.GetOrgByNameQuery) error {
+				query.Result = &models.Org{Id: orgID, Name: "test"}
+				return nil
+			})
+
+			sc.m.Get("/api/secure", ReqSignedInNoAnonymous, sc.defaultHandler)
+			sc.fakeReq("GET", "/api/secure").exec()
+
+			assert.Equal(t, 401, sc.resp.Code)
+		}, configure)
+
 		middlewareScenario(t, "ReqSignIn true and request with forceLogin in query string", func(
 			t *testing.T, sc *scenarioContext) {
 			bus.AddHandler("test", func(query *models.GetOrgByNameQuery) error {

pkg/middleware/middleware.go

@@ -15,9 +15,10 @@ var (
 		ReqSignedIn:     true,
 		ReqGrafanaAdmin: true,
 	})
-	ReqSignedIn   = Auth(&AuthOptions{ReqSignedIn: true})
-	ReqEditorRole = RoleAuth(models.ROLE_EDITOR, models.ROLE_ADMIN)
-	ReqOrgAdmin   = RoleAuth(models.ROLE_ADMIN)
+	ReqSignedIn            = Auth(&AuthOptions{ReqSignedIn: true})
+	ReqSignedInNoAnonymous = Auth(&AuthOptions{ReqSignedIn: true, ReqNoAnonynmous: true})
+	ReqEditorRole          = RoleAuth(models.ROLE_EDITOR, models.ROLE_ADMIN)
+	ReqOrgAdmin            = RoleAuth(models.ROLE_ADMIN)
 )
 
 func HandleNoCacheHeader(ctx *models.ReqContext) {