dashfolders: check permissions for new dashboard

ref #10275. Use the parent folder permissions if new dashboard and it does not have an id yet.
2018-01-09 14:44:36 +01:00
parent ae69c96518
commit c27a74bb6b
1 changed files with 8 additions and 1 deletions
@@ -158,7 +158,14 @@ func PostDashboard(c *middleware.Context, cmd m.SaveDashboardCommand) Response {

 	dash := cmd.GetDashboardModel()

-	guardian := guardian.NewDashboardGuardian(dash.Id, c.OrgId, c.SignedInUser)
+	dashId := dash.Id
+
+	// if new dashboard, use parent folder permissions instead
+	if dashId == 0 {
+		dashId = cmd.FolderId
+	}
+
+	guardian := guardian.NewDashboardGuardian(dashId, c.OrgId, c.SignedInUser)
 	if canSave, err := guardian.CanSave(); err != nil || !canSave {
 		return dashboardGuardianResponse(err)
 	}