From 7bf99231de44c53c54bb158256562dd204f49b80 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 5 Sep 2024 22:23:55 +0000 Subject: [PATCH] apply security patch: v10.3.x/0001-Alerting-Fix-permission-on-external-rule-write-endpo.patch commit 132e31627eb888b8b423a583e8bfdeb5dcfda976 Author: Alex Weaver Date: Thu Aug 22 12:15:32 2024 -0500 Alerting: Fix permission on external rule write endpoint --- pkg/services/ngalert/api/authorization.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/services/ngalert/api/authorization.go b/pkg/services/ngalert/api/authorization.go index a3d073b6236..661034fc1c6 100644 --- a/pkg/services/ngalert/api/authorization.go +++ b/pkg/services/ngalert/api/authorization.go @@ -93,7 +93,7 @@ func (api *API) authorize(method, path string) web.Handler { case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules": eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) case http.MethodPost + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}": - eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) + eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) // Lotex Prometheus-compatible Paths case http.MethodGet + "/api/prometheus/{DatasourceUID}/api/v1/rules":