From 8585273c2992a54d0ed6d0d40ce2ad74ce1f64c6 Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Wed, 8 Sep 2021 13:15:21 +0200 Subject: [PATCH] AccessControl: Restrict more the access to the data sources configuration tab (#38966) Co-authored-by: Emil Tullstedt --- pkg/api/index.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/pkg/api/index.go b/pkg/api/index.go index cf65f7bfd31..bc445f464f8 100644 --- a/pkg/api/index.go +++ b/pkg/api/index.go @@ -18,6 +18,16 @@ const ( darkName = "dark" ) +// dataSourcesConfigurationAccessEvaluator is used to protect the "Configure > Data sources" tab access +var dataSourcesConfigurationAccessEvaluator = ac.EvalAll( + ac.EvalPermission(ActionDatasourcesRead, ScopeDatasourcesAll), + ac.EvalAny( + ac.EvalPermission(ActionDatasourcesCreate), + ac.EvalPermission(ActionDatasourcesDelete), + ac.EvalPermission(ActionDatasourcesWrite), + ), +) + func (hs *HTTPServer) getProfileNode(c *models.ReqContext) *dtos.NavLink { // Only set login if it's different from the name var login string @@ -253,7 +263,7 @@ func (hs *HTTPServer) getNavTree(c *models.ReqContext, hasEditPerm bool) ([]*dto configNodes := []*dtos.NavLink{} - if hasAccess(ac.ReqOrgAdmin, ac.EvalPermission(ActionDatasourcesRead)) { + if hasAccess(ac.ReqOrgAdmin, dataSourcesConfigurationAccessEvaluator) { configNodes = append(configNodes, &dtos.NavLink{ Text: "Data sources", Icon: "database",