From 94e21de199f3457cb6b271ad1637bf51840147aa Mon Sep 17 00:00:00 2001
From: Johannes Schill <johannes80@polyester.se>
Date: Tue, 5 Mar 2019 12:41:01 +0100
Subject: [PATCH] Viewers with viewers_can_edit should be able to access
 /explore (#15787)

* fix: Viewers with viewers_can_edit should be able to access /explore #15773

* refactoring initial PR a bit to simplify function and reduce duplication

(cherry picked from commit a81d5486b096c77b4d39ee0483a0c127f4480881)
---
 pkg/api/api.go         | 2 +-
 pkg/middleware/auth.go | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkg/api/api.go b/pkg/api/api.go
index c80129eac6f..81ea83eae61 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -73,7 +73,7 @@ func (hs *HTTPServer) registerRoutes() {
 	r.Get("/dashboards/", reqSignedIn, hs.Index)
 	r.Get("/dashboards/*", reqSignedIn, hs.Index)
 
-	r.Get("/explore", reqEditorRole, hs.Index)
+	r.Get("/explore", reqSignedIn, middleware.EnsureEditorOrViewerCanEdit, hs.Index)
 
 	r.Get("/playlists/", reqSignedIn, hs.Index)
 	r.Get("/playlists/*", reqSignedIn, hs.Index)
diff --git a/pkg/middleware/auth.go b/pkg/middleware/auth.go
index 27248342c8d..e06409211eb 100644
--- a/pkg/middleware/auth.go
+++ b/pkg/middleware/auth.go
@@ -4,7 +4,7 @@ import (
 	"net/url"
 	"strings"
 
-	"gopkg.in/macaron.v1"
+	macaron "gopkg.in/macaron.v1"
 
 	m "github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/setting"
@@ -52,6 +52,12 @@ func notAuthorized(c *m.ReqContext) {
 	c.Redirect(setting.AppSubUrl + "/login")
 }
 
+func EnsureEditorOrViewerCanEdit(c *m.ReqContext) {
+	if !c.SignedInUser.HasRole(m.ROLE_EDITOR) && !setting.ViewersCanEdit {
+		accessForbidden(c)
+	}
+}
+
 func RoleAuth(roles ...m.RoleType) macaron.Handler {
 	return func(c *m.ReqContext) {
 		ok := false