diff --git a/pkg/services/authz/rbac/service.go b/pkg/services/authz/rbac/service.go index e45346740cc..5ef2e0c5ad6 100644 --- a/pkg/services/authz/rbac/service.go +++ b/pkg/services/authz/rbac/service.go @@ -618,6 +618,7 @@ func (s *Service) checkPermission(ctx context.Context, scopeMap map[string]bool, } if t.SkipScope(req.Verb) { + // Resource doesn't require scope on this verb, so allow if the user has the action return scopeMap[""], nil } @@ -627,18 +628,6 @@ func (s *Service) checkPermission(ctx context.Context, scopeMap map[string]bool, req.ParentFolder = accesscontrol.GeneralFolderUID } - //if req.Verb == utils.VerbCreate { - // // Resource doesn't require scope on create, so allow if the user has the action - // if t.SkipScopeOnCreate() { - // return scopeMap[""], nil - // } - // // If creating a resource that goes in a folder, but no folder is specified, - // // assume parent folder is the general folder - // if t.HasFolderSupport() && req.ParentFolder == "" { - // req.ParentFolder = accesscontrol.GeneralFolderUID - // } - //} - // Wildcard grant, no further checks needed if scopeMap["*"] { return true, nil