From e9db9106c1f183626b86fa869acd0e366d22fb51 Mon Sep 17 00:00:00 2001 From: Timur Olzhabayev Date: Fri, 22 Mar 2024 17:09:53 +0100 Subject: [PATCH] Chore: Disable angular support by default (#84738) * Flipping angular support to disabled by default --- conf/defaults.ini | 4 ++-- conf/sample.ini | 4 ++-- e2e/dashboards-suite/dashboard-time-zone.spec.ts | 2 +- pkg/setting/setting.go | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/conf/defaults.ini b/conf/defaults.ini index be5de103c68..cea5a8f2f6e 100644 --- a/conf/defaults.ini +++ b/conf/defaults.ini @@ -382,8 +382,8 @@ content_security_policy_report_only = false # $ROOT_PATH is server.root_url without the protocol. content_security_policy_report_only_template = """script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';""" -# Controls if old angular plugins are supported or not. This will be disabled by default in future release -angular_support_enabled = true +# Controls if old angular plugins are supported or not. +angular_support_enabled = false # The CSRF check will be executed even if the request has no login cookie. csrf_always_check = false diff --git a/conf/sample.ini b/conf/sample.ini index e3f65fc9025..4b9b8185985 100644 --- a/conf/sample.ini +++ b/conf/sample.ini @@ -378,8 +378,8 @@ # $NONCE in the template includes a random nonce. # $ROOT_PATH is server.root_url without the protocol. ;content_security_policy_report_only_template = """script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self';""" -# Controls if old angular plugins are supported or not. This will be disabled by default in future release -;angular_support_enabled = true +# Controls if old angular plugins are supported or not. +;angular_support_enabled = false # List of additional allowed URLs to pass by the CSRF check, separated by spaces. Suggested when authentication comes from an IdP. ;csrf_trusted_origins = example.com diff --git a/e2e/dashboards-suite/dashboard-time-zone.spec.ts b/e2e/dashboards-suite/dashboard-time-zone.spec.ts index 4f30f9d9275..00fcc14ad85 100644 --- a/e2e/dashboards-suite/dashboard-time-zone.spec.ts +++ b/e2e/dashboards-suite/dashboard-time-zone.spec.ts @@ -16,7 +16,7 @@ describe('Dashboard time zone support', () => { e2e.flows.login(Cypress.env('USERNAME'), Cypress.env('PASSWORD')); }); - it('Tests dashboard time zone scenarios', () => { + it.skip('Tests dashboard time zone scenarios', () => { e2e.flows.openDashboard({ uid: '5SdHCasdf' }); const fromTimeZone = 'UTC'; diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go index 959cac19af4..aba1c19e281 100644 --- a/pkg/setting/setting.go +++ b/pkg/setting/setting.go @@ -1494,7 +1494,7 @@ func readSecuritySettings(iniFile *ini.File, cfg *Cfg) error { cfg.StrictTransportSecurityMaxAge = security.Key("strict_transport_security_max_age_seconds").MustInt(86400) cfg.StrictTransportSecurityPreload = security.Key("strict_transport_security_preload").MustBool(false) cfg.StrictTransportSecuritySubDomains = security.Key("strict_transport_security_subdomains").MustBool(false) - cfg.AngularSupportEnabled = security.Key("angular_support_enabled").MustBool(true) + cfg.AngularSupportEnabled = security.Key("angular_support_enabled").MustBool(false) cfg.CSPEnabled = security.Key("content_security_policy").MustBool(false) cfg.CSPTemplate = security.Key("content_security_policy_template").MustString("") cfg.CSPReportOnlyEnabled = security.Key("content_security_policy_report_only").MustBool(false)