From 6a723dff37ddc6ec0235cdb5ef30a298c82a1895 Mon Sep 17 00:00:00 2001
From: bergquist <carl.bergquist@gmail.com>
Date: Tue, 13 Sep 2016 14:25:48 +0200
Subject: [PATCH 1/2] feat(notifications): set default value to false for new
 notifications

---
 public/app/features/alerting/alert_tab_ctrl.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/public/app/features/alerting/alert_tab_ctrl.ts b/public/app/features/alerting/alert_tab_ctrl.ts
index b372520507d..8cb0f09ee9c 100644
--- a/public/app/features/alerting/alert_tab_ctrl.ts
+++ b/public/app/features/alerting/alert_tab_ctrl.ts
@@ -130,7 +130,11 @@ export class AlertTabCtrl {
       return;
     }
 
-    this.alertNotifications.push({name: model.name, iconClass: this.getNotificationIcon(model.type)});
+    this.alertNotifications.push({
+      name: model.name,
+      iconClass: this.getNotificationIcon(model.type),
+      isDefault: false
+    });
     this.alert.notifications.push({id: model.id});
 
     // reset plus button

From a73424d6af55528531ca70fbcec9e36c86e5d62c Mon Sep 17 00:00:00 2001
From: wvl <leesew@gmail.com>
Date: Tue, 13 Sep 2016 15:04:21 +0200
Subject: [PATCH 2/2] Secure Elasticsearch datasources a bit (#6031)

Instead of allowing users to access the
entire cluster, apply some sane restrictions.

Change-Id: Ib2e93722bf2e39d700d4afa713ff49ec556f2fdf
---
 pkg/api/dataproxy.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkg/api/dataproxy.go b/pkg/api/dataproxy.go
index 66d654d4d93..97f2529c781 100644
--- a/pkg/api/dataproxy.go
+++ b/pkg/api/dataproxy.go
@@ -104,6 +104,22 @@ func ProxyDataSourceRequest(c *middleware.Context) {
 	}
 
 	proxyPath := c.Params("*")
+
+	if ds.Type == m.DS_ES {
+		if c.Req.Request.Method == "DELETE" {
+			c.JsonApiErr(403, "Deletes not allowed on proxied Elasticsearch datasource", nil)
+			return
+		}
+		if c.Req.Request.Method == "PUT" {
+			c.JsonApiErr(403, "Puts not allowed on proxied Elasticsearch datasource", nil)
+			return
+		}
+		if c.Req.Request.Method == "POST" && proxyPath != "_msearch" {
+			c.JsonApiErr(403, "Posts not allowed on proxied Elasticsearch datasource except on /_msearch", nil)
+			return
+		}
+	}
+
 	proxy := NewReverseProxy(ds, proxyPath, targetUrl)
 	proxy.Transport = dataProxyTransport
 	proxy.ServeHTTP(c.Resp, c.Req.Request)