From 0cafd9a66338ef098f32d74425adbb0eaf8050bb Mon Sep 17 00:00:00 2001 From: Kornelijus Survila Date: Fri, 30 Nov 2018 12:12:55 -0700 Subject: [PATCH 01/12] dataproxy: Override incoming Authorization header --- pkg/api/pluginproxy/ds_auth_provider.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/api/pluginproxy/ds_auth_provider.go b/pkg/api/pluginproxy/ds_auth_provider.go index edf43085c7c..5c5776eec07 100644 --- a/pkg/api/pluginproxy/ds_auth_provider.go +++ b/pkg/api/pluginproxy/ds_auth_provider.go @@ -51,7 +51,7 @@ func ApplyRoute(ctx context.Context, req *http.Request, proxyPath string, route if token, err := tokenProvider.getAccessToken(data); err != nil { logger.Error("Failed to get access token", "error", err) } else { - req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token)) + req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token)) } } @@ -60,7 +60,7 @@ func ApplyRoute(ctx context.Context, req *http.Request, proxyPath string, route if token, err := tokenProvider.getJwtAccessToken(ctx, data); err != nil { logger.Error("Failed to get access token", "error", err) } else { - req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token)) + req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token)) } } @@ -73,7 +73,7 @@ func ApplyRoute(ctx context.Context, req *http.Request, proxyPath string, route if err != nil { logger.Error("Failed to get default access token from meta data server", "error", err) } else { - req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.AccessToken)) + req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token.AccessToken)) } } } From 474197269ebd2a1637e3661199877772cae1379d Mon Sep 17 00:00:00 2001 From: SilverFire - Dmitry Naumenko Date: Thu, 29 Nov 2018 14:34:11 +0200 Subject: [PATCH 02/12] Prevent password reset when login form is disabled or either LDAP or Auth Proxy is enabled --- pkg/api/password.go | 8 ++++++++ public/app/partials/reset_password.html | 9 ++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/pkg/api/password.go b/pkg/api/password.go index 7dd901c898e..4776c6a3064 100644 --- a/pkg/api/password.go +++ b/pkg/api/password.go @@ -4,10 +4,18 @@ import ( "github.com/grafana/grafana/pkg/api/dtos" "github.com/grafana/grafana/pkg/bus" m "github.com/grafana/grafana/pkg/models" + "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/util" ) func SendResetPasswordEmail(c *m.ReqContext, form dtos.SendResetPasswordEmailForm) Response { + if setting.LdapEnabled || setting.AuthProxyEnabled { + return Error(401, "Not allowed to reset password when LDAP or Auth Proxy is enabled", nil) + } + if setting.DisableLoginForm { + return Error(401, "Not allowed to reset password when login form is disabled", nil) + } + userQuery := m.GetUserByLoginQuery{LoginOrEmail: form.UserOrEmail} if err := bus.Dispatch(&userQuery); err != nil { diff --git a/public/app/partials/reset_password.html b/public/app/partials/reset_password.html index 138aa1b7c62..bba38af0235 100644 --- a/public/app/partials/reset_password.html +++ b/public/app/partials/reset_password.html @@ -3,7 +3,14 @@