From 8d938175f5d770c6a33921673a5d321328c25881 Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Fri, 22 Jul 2022 10:35:26 +0200 Subject: [PATCH] Fix anonymous access (#52615) --- .../dashboards/service/dashboard_service.go | 4 ++-- pkg/services/dashboards/service/folder_service.go | 14 +++++++++++--- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/pkg/services/dashboards/service/dashboard_service.go b/pkg/services/dashboards/service/dashboard_service.go index e5a10f6fbd7..1f896772e0b 100644 --- a/pkg/services/dashboards/service/dashboard_service.go +++ b/pkg/services/dashboards/service/dashboard_service.go @@ -470,7 +470,7 @@ func (dr *DashboardServiceImpl) setDefaultPermissions(ctx context.Context, dto * inFolder := dash.FolderId > 0 if !accesscontrol.IsDisabled(dr.cfg) { var permissions []accesscontrol.SetResourcePermissionCommand - if !provisioned { + if !provisioned && dto.User.IsRealUser() && !dto.User.IsAnonymous { permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{ UserID: dto.User.UserId, Permission: models.PERMISSION_ADMIN.String(), }) @@ -492,7 +492,7 @@ func (dr *DashboardServiceImpl) setDefaultPermissions(ctx context.Context, dto * if err != nil { return err } - } else if dr.cfg.EditorsCanAdmin && !provisioned { + } else if dr.cfg.EditorsCanAdmin && !provisioned && dto.User.IsRealUser() && !dto.User.IsAnonymous { if err := dr.MakeUserAdmin(ctx, dto.OrgId, dto.User.UserId, dash.Id, !inFolder); err != nil { return err } diff --git a/pkg/services/dashboards/service/folder_service.go b/pkg/services/dashboards/service/folder_service.go index de4f3016821..6c16e75a21b 100644 --- a/pkg/services/dashboards/service/folder_service.go +++ b/pkg/services/dashboards/service/folder_service.go @@ -176,12 +176,20 @@ func (f *FolderServiceImpl) CreateFolder(ctx context.Context, user *models.Signe var permissionErr error if !accesscontrol.IsDisabled(f.cfg) { - _, permissionErr = f.permissions.SetPermissions(ctx, orgID, folder.Uid, []accesscontrol.SetResourcePermissionCommand{ - {UserID: userID, Permission: models.PERMISSION_ADMIN.String()}, + var permissions []accesscontrol.SetResourcePermissionCommand + if user.IsRealUser() && !user.IsAnonymous { + permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{ + UserID: userID, Permission: models.PERMISSION_ADMIN.String(), + }) + } + + permissions = append(permissions, []accesscontrol.SetResourcePermissionCommand{ {BuiltinRole: string(models.ROLE_EDITOR), Permission: models.PERMISSION_EDIT.String()}, {BuiltinRole: string(models.ROLE_VIEWER), Permission: models.PERMISSION_VIEW.String()}, }...) - } else if f.cfg.EditorsCanAdmin { + + _, permissionErr = f.permissions.SetPermissions(ctx, orgID, folder.Uid, permissions...) + } else if f.cfg.EditorsCanAdmin && user.IsRealUser() && !user.IsAnonymous { permissionErr = f.MakeUserAdmin(ctx, orgID, userID, folder.Id, true) }