From 9feaa91bf5a5f33e961f5453f9263b0f15b99e91 Mon Sep 17 00:00:00 2001
From: Will Browne <wbrowne@users.noreply.github.com>
Date: Tue, 25 Aug 2020 14:35:57 +0200
Subject: [PATCH] Alerting: Store sensitive settings encrypted for Telegram
 notifier (#27122)

* encrypt bot token

* update docs

* re-add uploadImage to docs
---
 docs/sources/administration/provisioning.md | 10 ++---
 pkg/services/alerting/notifiers/telegram.go | 48 +++++++++++++--------
 2 files changed, 34 insertions(+), 24 deletions(-)

diff --git a/docs/sources/administration/provisioning.md b/docs/sources/administration/provisioning.md
index 61e15606a6d..4a66f982188 100644
--- a/docs/sources/administration/provisioning.md
+++ b/docs/sources/administration/provisioning.md
@@ -520,11 +520,11 @@ The following sections detail the supported settings and secure settings for eac
 
 #### Alert notification `telegram`
 
-| Name        |
-| ----------- |
-| bottoken    |
-| chatid      |
-| uploadImage |
+| Name        | Secure setting |
+| ----------- | - |
+| bottoken    | yes |
+| chatid      | |
+| uploadImage | |
 
 #### Alert notification `threema`
 
diff --git a/pkg/services/alerting/notifiers/telegram.go b/pkg/services/alerting/notifiers/telegram.go
index 5b69207388e..86fdbaeb4d8 100644
--- a/pkg/services/alerting/notifiers/telegram.go
+++ b/pkg/services/alerting/notifiers/telegram.go
@@ -29,25 +29,35 @@ func init() {
 		Heading:     "Telegram API settings",
 		Factory:     NewTelegramNotifier,
 		OptionsTemplate: `
-      <h3 class="page-heading">Telegram API settings</h3>
-      <div class="gf-form">
-        <span class="gf-form-label width-9">BOT API Token</span>
-        <input type="text" required
-					class="gf-form-input"
-					ng-model="ctrl.model.settings.bottoken"
-					placeholder="Telegram BOT API Token"></input>
-      </div>
-      <div class="gf-form">
-        <span class="gf-form-label width-9">Chat ID</span>
-        <input type="text" required
-					class="gf-form-input"
-					ng-model="ctrl.model.settings.chatid"
+		<h3 class="page-heading">Telegram API settings</h3>
+		<div class="gf-form max-width-30">
+			<label class="gf-form-label width-10">BOT API Token</label>
+			<div class="gf-form gf-form--grow" ng-if="!ctrl.model.secureFields.bottoken">
+				<input type="text"
+					required
+					class="gf-form-input max-width-30"
+					ng-init="ctrl.model.secureSettings.bottoken = ctrl.model.settings.bottoken || null; ctrl.model.settings.bottoken = null;"
+					ng-model="ctrl.model.secureSettings.bottoken"
+					placeholder="Telegram BOT API Token"
 					data-placement="right">
-        </input>
-        <info-popover mode="right-absolute">
-					Integer Telegram Chat Identifier
-        </info-popover>
-      </div>
+				</input>
+			</div>
+			<div class="gf-form" ng-if="ctrl.model.secureFields.bottoken">
+			  <input type="text" class="gf-form-input max-width-18" disabled="disabled" value="configured" />
+			  <a class="btn btn-secondary gf-form-btn" href="#" ng-click="ctrl.model.secureFields.bottoken = false">reset</a>
+			</div>
+		</div>
+		<div class="gf-form max-width-30">
+			<label class="gf-form-label width-10">Chat ID</label>
+			<input type="text"
+				required
+				class="gf-form-input max-width-30"
+				ng-model="ctrl.model.settings.chatid"
+				placeholder="Telegram Chat ID"
+				data-placement="right">
+			</input>
+			<info-popover mode="right-absolute">Integer Telegram Chat Identifier</info-popover>
+		</div>
     `,
 		Options: []alerting.NotifierOption{
 			{
@@ -86,7 +96,7 @@ func NewTelegramNotifier(model *models.AlertNotification) (alerting.Notifier, er
 		return nil, alerting.ValidationError{Reason: "No Settings Supplied"}
 	}
 
-	botToken := model.Settings.Get("bottoken").MustString()
+	botToken := model.DecryptedValue("bottoken", model.Settings.Get("bottoken").MustString())
 	chatID := model.Settings.Get("chatid").MustString()
 	uploadImage := model.Settings.Get("uploadImage").MustBool()