From 9500c94c9813801e2dccd8990b488566d474a0d3 Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Thu, 9 Jun 2022 05:45:29 -0600
Subject: [PATCH] [v8.5.x] RBAC: drop permissions with folder:create action
 added by migration (#50493)

* add migrator to drop folder create actions that was set fromt he folder (#49878)

(cherry picked from commit f4f25d911b77f98ed3748365b807360d3d219926)

* Add missing const

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>
---
 .../accesscontrol/dashboard_permissions.go     | 18 ++++++++++++++++--
 .../migrations/accesscontrol/migrations.go     |  2 ++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go b/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go
index ea76bb15232..5811a290cdd 100644
--- a/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go
+++ b/pkg/services/sqlstore/migrations/accesscontrol/dashboard_permissions.go
@@ -41,13 +41,11 @@ var folderPermissionTranslation = map[models.PermissionType][]string{
 		ac.ActionDashboardsCreate,
 		dashboards.ActionFoldersRead,
 		dashboards.ActionFoldersWrite,
-		dashboards.ActionFoldersCreate,
 		dashboards.ActionFoldersDelete,
 	}...),
 	models.PERMISSION_ADMIN: append(dashboardPermissionTranslation[models.PERMISSION_ADMIN], []string{
 		dashboards.ActionFoldersRead,
 		dashboards.ActionFoldersWrite,
-		dashboards.ActionFoldersCreate,
 		dashboards.ActionFoldersDelete,
 		dashboards.ActionFoldersPermissionsRead,
 		dashboards.ActionFoldersPermissionsWrite,
@@ -57,6 +55,7 @@ var folderPermissionTranslation = map[models.PermissionType][]string{
 func AddDashboardPermissionsMigrator(mg *migrator.Migrator) {
 	mg.AddMigration("dashboard permissions", &dashboardPermissionsMigrator{})
 	mg.AddMigration("dashboard permissions uid scopes", &dashboardUidPermissionMigrator{})
+	mg.AddMigration("drop managed folder create actions", &managedFolderCreateAction{})
 }
 
 var _ migrator.CodeMigration = new(dashboardPermissionsMigrator)
@@ -280,3 +279,18 @@ func (d *dashboardUidPermissionMigrator) migrateIdScopes(sess *xorm.Session) err
 	}
 	return nil
 }
+
+type managedFolderCreateAction struct {
+	migrator.MigrationBase
+}
+
+func (m *managedFolderCreateAction) SQL(dialect migrator.Dialect) string {
+	return CodeMigrationSQL
+}
+
+func (m *managedFolderCreateAction) Exec(sess *xorm.Session, migrator *migrator.Migrator) error {
+	if _, err := sess.Exec("DELETE FROM permission WHERE action = 'folders:create' AND scope LIKE 'folders:uid:%'"); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/services/sqlstore/migrations/accesscontrol/migrations.go b/pkg/services/sqlstore/migrations/accesscontrol/migrations.go
index 38f880f5674..eb923a688c1 100644
--- a/pkg/services/sqlstore/migrations/accesscontrol/migrations.go
+++ b/pkg/services/sqlstore/migrations/accesscontrol/migrations.go
@@ -2,6 +2,8 @@ package accesscontrol
 
 import "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
 
+const CodeMigrationSQL = "code migration"
+
 func AddMigration(mg *migrator.Migrator) {
 	permissionV1 := migrator.Table{
 		Name: "permission",