From 9a280fa66069b8ffe2dff59506db79e5a5a1219a Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Mon, 28 Oct 2024 14:40:17 +0200 Subject: [PATCH] [v10.4.x] User: Check SignedInUser OrgID in RevokeInvite (#95486) User: Check SignedInUser OrgID in RevokeInvite (#95476) Check SignedInUser OrgID in RevokeInvite (cherry picked from commit fedcf4770260f8762c9cbbab618ff687b4036fe5) Co-authored-by: Misi --- pkg/api/org_invite.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pkg/api/org_invite.go b/pkg/api/org_invite.go index af21963d7f7..c5e0083550f 100644 --- a/pkg/api/org_invite.go +++ b/pkg/api/org_invite.go @@ -201,6 +201,20 @@ func (hs *HTTPServer) inviteExistingUserToOrg(c *contextmodel.ReqContext, user * // 404: notFoundError // 500: internalServerError func (hs *HTTPServer) RevokeInvite(c *contextmodel.ReqContext) response.Response { + query := tempuser.GetTempUserByCodeQuery{Code: web.Params(c.Req)[":code"]} + queryResult, err := hs.tempUserService.GetTempUserByCode(c.Req.Context(), &query) + if err != nil { + if errors.Is(err, tempuser.ErrTempUserNotFound) { + return response.Error(http.StatusNotFound, "Invite not found", nil) + } + return response.Error(http.StatusInternalServerError, "Failed to get invite", err) + } + + canRevoke := c.SignedInUser.GetOrgID() == queryResult.OrgID || c.SignedInUser.GetIsGrafanaAdmin() + if !canRevoke { + return response.Error(http.StatusForbidden, "Permission denied: not permitted to revoke invite", nil) + } + if ok, rsp := hs.updateTempUserStatus(c.Req.Context(), web.Params(c.Req)[":code"], tempuser.TmpUserRevoked); !ok { return rsp }