From c27a74bb6be6df4e091e19b5a673a08add09daba Mon Sep 17 00:00:00 2001 From: Daniel Lee Date: Thu, 21 Dec 2017 15:31:41 +0100 Subject: [PATCH] dashfolders: check permissions for new dashboard ref #10275. Use the parent folder permissions if new dashboard and it does not have an id yet. --- pkg/api/dashboard.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkg/api/dashboard.go b/pkg/api/dashboard.go index 9c0d018281d..a72fc0fafbc 100644 --- a/pkg/api/dashboard.go +++ b/pkg/api/dashboard.go @@ -158,7 +158,14 @@ func PostDashboard(c *middleware.Context, cmd m.SaveDashboardCommand) Response { dash := cmd.GetDashboardModel() - guardian := guardian.NewDashboardGuardian(dash.Id, c.OrgId, c.SignedInUser) + dashId := dash.Id + + // if new dashboard, use parent folder permissions instead + if dashId == 0 { + dashId = cmd.FolderId + } + + guardian := guardian.NewDashboardGuardian(dashId, c.OrgId, c.SignedInUser) if canSave, err := guardian.CanSave(); err != nil || !canSave { return dashboardGuardianResponse(err) }