From d47310e4571d35b21842838e946dc2c0955c11a8 Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Thu, 2 May 2024 13:36:10 +0300 Subject: [PATCH] [v11.0.x] RBAC: Do not set permissions on data sources with wildcard UID in OSS (#87222) RBAC: Do not set permissions on data sources with wildcard UID in OSS (#87220) do not set permissions on DS with wildcard UID (cherry picked from commit 28dd1ddd8eb1b6d22b0a42dcc23c67985557c440) Co-authored-by: Ieva --- .../accesscontrol/ossaccesscontrol/permissions_services.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go b/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go index b1f50e90702..ad25da579b4 100644 --- a/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go +++ b/pkg/services/accesscontrol/ossaccesscontrol/permissions_services.go @@ -320,8 +320,8 @@ func (e DatasourcePermissionsService) SetBuiltInRolePermission(ctx context.Conte func (e DatasourcePermissionsService) SetPermissions(ctx context.Context, orgID int64, resourceID string, commands ...accesscontrol.SetResourcePermissionCommand) ([]accesscontrol.ResourcePermission, error) { var dbCommands []resourcepermissions.SetResourcePermissionsCommand for _, cmd := range commands { - // Only set query permissions for built-in roles - if cmd.Permission != "Query" || cmd.BuiltinRole == "" { + // Only set query permissions for built-in roles; do not set permissions for data sources with * as UID, as this would grant wildcard permissions + if cmd.Permission != "Query" || cmd.BuiltinRole == "" || resourceID == "*" { continue } actions := DatasourceQueryActions