public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: sql search permissions filter fix

Browse Source
This commit is contained in:
Torkel Ödegaard
2018-02-13 16:49:00 +01:00
parent 4d5a24a6c4
commit e3c3f3ce4c
4 changed files with 53 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/sqlbuilder.go
+20 -26
View File
@@ -24,39 +24,33 @@ func (sb *SqlBuilder) writeDashboardPermissionFilter(user *m.SignedInUser, permi
okRoles = append(okRoles, m.ROLE_VIEWER)
}
// SELECT dash.id, dash.title, dash.folder_id
// FROM dashboard AS dash
// LEFT JOIN dashboard folder on folder.id = dash.folder_id
// LEFT JOIN dashboard_acl AS da ON
// da.dashboard_id = dash.id OR
// da.dashboard_id = dash.folder_id OR
// (
// -- include default permissions -->
// da.org_id = -1 AND (folder.has_acl = 0 OR (dash.has_acl = 0 AND dash.folder_id = 0))
// )
// LEFT JOIN team_member as ugm on ugm.team_id = da.team_id
// WHERE
// dash.org_id = 5 AND
// (
// da.user_id = 8 or
// ugm.user_id = 8 or
// da.role in ('Viewer', 'Editor')
// ) AND
// da.permission > 1
//
falseStr := dialect.BooleanStr(false)
sb.sql.WriteString(` AND
(
dashboard.has_acl = ` + dialect.BooleanStr(false) + ` OR
dashboard.id in (
dashboard.id IN (
SELECT distinct d.id AS DashboardId
FROM dashboard AS d
LEFT JOIN dashboard_acl as da on d.folder_id = da.dashboard_id or d.id = da.dashboard_id
LEFT JOIN team_member as ugm on ugm.team_id = da.team_id
LEFT JOIN dashboard folder on folder.id = d.folder_id
LEFT JOIN dashboard_acl AS da ON
da.dashboard_id = d.id OR
da.dashboard_id = d.folder_id OR
(
-- include default permissions -->
da.org_id = -1 AND (
(folder.id IS NOT NULL AND folder.has_acl = ` + falseStr + `) OR
(folder.id IS NULL AND d.has_acl = ` + falseStr + `)
)
)
LEFT JOIN team_member as ugm on ugm.team_id = da.team_id
WHERE
d.has_acl = ` + dialect.BooleanStr(true) + ` AND
d.org_id = ? AND
da.permission >= ? AND
(da.user_id = ? or ugm.user_id = ? or da.role IN (?` + strings.Repeat(",?", len(okRoles)-1) + `))
(
da.user_id = ? OR
ugm.user_id = ? OR
da.role IN (?` + strings.Repeat(",?", len(okRoles)-1) + `)
)
)
)`)