public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthZ service: Take action sets into account when checking folder create permissions (#98751)

Browse Source 
take action sets into account when checking folder create permissions
This commit is contained in:
Ieva
2025-01-14 08:33:42 +00:00
committed by GitHub
parent 05ea05d64e
commit 9b34a56d7c
20 changed files with 103 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/rbac/store/permission_query.sql
+8 -2
View File
@@ -1,5 +1,11 @@
SELECT p.action, p.kind, p.attribute, p.identifier, p.scope FROM {{ .Ident .PermissionTable }} as p
WHERE p.action = {{ .Arg .Query.Action }} AND p.role_id IN (
SELECT p.kind, p.attribute, p.identifier, p.scope FROM {{ .Ident .PermissionTable }} as p
WHERE
{{ if .Query.ActionSets }}
p.action IN ({{ .ArgList .Query.ActionSets }}, {{ .Arg .Query.Action }})
{{ else }}
p.action = {{ .Arg .Query.Action }}
{{ end }}
AND p.role_id IN (
SELECT role_id FROM {{ .Ident .BuiltinRoleTable }} as br WHERE (br.role = {{ .Arg .Query.Role }} AND (br.org_id = {{ .Arg .Query.OrgID }} OR br.org_id = 0))
{{ if .Query.IsServerAdmin }}
OR (br.role = 'Grafana Admin')