From 783cbd8a148eb0c0a017a01c0dbe1138fe5e8e24 Mon Sep 17 00:00:00 2001 From: Ryan McKinley Date: Tue, 19 Mar 2024 21:12:22 +0300 Subject: [PATCH] [v10.1.x] Snapshots: Require delete within same org (backport) (#84765) * manual fix * manual fix --- pkg/api/dashboard_snapshot.go | 3 +++ pkg/api/dashboard_snapshot_test.go | 14 +++++++------- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/pkg/api/dashboard_snapshot.go b/pkg/api/dashboard_snapshot.go index 3dbe4e08657..7a828d7f3e4 100644 --- a/pkg/api/dashboard_snapshot.go +++ b/pkg/api/dashboard_snapshot.go @@ -349,6 +349,9 @@ func (hs *HTTPServer) DeleteDashboardSnapshot(c *contextmodel.ReqContext) respon if queryResult == nil { return response.Error(http.StatusNotFound, "Failed to get dashboard snapshot", nil) } + if queryResult.OrgID != c.OrgID { + return response.Error(http.StatusUnauthorized, "OrgID mismatch", nil) + } if queryResult.External { err := deleteExternalDashboardSnapshot(queryResult.ExternalDeleteURL) diff --git a/pkg/api/dashboard_snapshot_test.go b/pkg/api/dashboard_snapshot_test.go index 4028904cbc9..a81150bd569 100644 --- a/pkg/api/dashboard_snapshot_test.go +++ b/pkg/api/dashboard_snapshot_test.go @@ -44,6 +44,7 @@ func TestDashboardSnapshotAPIEndpoint_singleSnapshot(t *testing.T) { dashSnapSvc.On("DeleteDashboardSnapshot", mock.Anything, mock.AnythingOfType("*dashboardsnapshots.DeleteDashboardSnapshotCommand")).Return(nil).Maybe() res := &dashboardsnapshots.DashboardSnapshot{ ID: 1, + OrgID: 1, Key: "12345", DeleteKey: "54321", Dashboard: jsonModel, @@ -103,12 +104,11 @@ func TestDashboardSnapshotAPIEndpoint_singleSnapshot(t *testing.T) { sc.handlerFunc = hs.DeleteDashboardSnapshotByDeleteKey sc.fakeReqWithParams("GET", sc.url, map[string]string{"deleteKey": "12345"}).exec() - require.Equal(t, 200, sc.resp.Code) + require.Equal(t, 200, sc.resp.Code, "BODY: "+sc.resp.Body.String()) respJSON, err := simplejson.NewJson(sc.resp.Body.Bytes()) require.NoError(t, err) assert.True(t, strings.HasPrefix(respJSON.Get("message").MustString(), "Snapshot deleted")) - assert.Equal(t, 1, respJSON.Get("id").MustInt()) assert.Equal(t, http.MethodGet, externalRequest.Method) assert.Equal(t, ts.URL, fmt.Sprintf("http://%s", externalRequest.Host)) @@ -333,7 +333,7 @@ func TestGetDashboardSnapshotNotFound(t *testing.T) { sc.handlerFunc = hs.DeleteDashboardSnapshot sc.fakeReqWithParams("DELETE", sc.url, map[string]string{"key": "12345"}).exec() - assert.Equal(t, http.StatusNotFound, sc.resp.Code) + assert.Equal(t, http.StatusNotFound, sc.resp.Code, "BODY: "+sc.resp.Body.String()) }, sqlmock) loggedInUserScenarioWithRole(t, @@ -344,7 +344,7 @@ func TestGetDashboardSnapshotNotFound(t *testing.T) { sc.handlerFunc = hs.DeleteDashboardSnapshotByDeleteKey sc.fakeReqWithParams("DELETE", sc.url, map[string]string{"deleteKey": "12345"}).exec() - assert.Equal(t, http.StatusNotFound, sc.resp.Code) + assert.Equal(t, http.StatusNotFound, sc.resp.Code, "BODY: "+sc.resp.Body.String()) }, sqlmock) } @@ -407,7 +407,7 @@ func TestGetDashboardSnapshotFailure(t *testing.T) { sc.handlerFunc = hs.DeleteDashboardSnapshot sc.fakeReqWithParams("DELETE", sc.url, map[string]string{"key": "12345"}).exec() - assert.Equal(t, http.StatusForbidden, sc.resp.Code) + assert.Equal(t, http.StatusForbidden, sc.resp.Code, "BODY: "+sc.resp.Body.String()) }, sqlmock) loggedInUserScenarioWithRole(t, @@ -418,7 +418,7 @@ func TestGetDashboardSnapshotFailure(t *testing.T) { sc.handlerFunc = hs.DeleteDashboardSnapshotByDeleteKey sc.fakeReqWithParams("DELETE", sc.url, map[string]string{"deleteKey": "12345"}).exec() - assert.Equal(t, http.StatusInternalServerError, sc.resp.Code) + assert.Equal(t, http.StatusInternalServerError, sc.resp.Code, "BODY: "+sc.resp.Body.String()) }, sqlmock) loggedInUserScenarioWithRole(t, @@ -429,7 +429,7 @@ func TestGetDashboardSnapshotFailure(t *testing.T) { sc.handlerFunc = hs.DeleteDashboardSnapshotByDeleteKey sc.fakeReqWithParams("DELETE", sc.url, map[string]string{"deleteKey": "12345"}).exec() - assert.Equal(t, http.StatusForbidden, sc.resp.Code) + assert.Equal(t, http.StatusForbidden, sc.resp.Code, "BODY: "+sc.resp.Body.String()) }, sqlmock) }