From f345d7f6a3bff2e084840f8b08e879b02bb80831 Mon Sep 17 00:00:00 2001
From: Dominik Prokop <dominik.prokop@grafana.com>
Date: Mon, 16 Mar 2020 15:40:46 +0100
Subject: [PATCH] Plugins: Hide plugins page from viewers, and limit
 /api/plugins to only core plugins when called by viewer role  (#21901)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Hide plugins list from viewers

* Made /api/plugins only return core plugins for users with viewer role

Co-authored-by: Torkel Ödegaard <torkel@grafana.com>
---
 pkg/api/index.go   | 36 +++++++++++++++++++-----------------
 pkg/api/plugins.go |  7 ++++++-
 2 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/pkg/api/index.go b/pkg/api/index.go
index 49b67bbd7e0..0e9e475f992 100644
--- a/pkg/api/index.go
+++ b/pkg/api/index.go
@@ -297,15 +297,15 @@ func (hs *HTTPServer) setIndexViewData(c *models.ReqContext) (*dtos.IndexViewDat
 		})
 	}
 
-	configNodes = append(configNodes, &dtos.NavLink{
-		Text:        "Plugins",
-		Id:          "plugins",
-		Description: "View and configure plugins",
-		Icon:        "gicon gicon-plugins",
-		Url:         setting.AppSubUrl + "/plugins",
-	})
-
 	if c.OrgRole == models.ROLE_ADMIN {
+		configNodes = append(configNodes, &dtos.NavLink{
+			Text:        "Plugins",
+			Id:          "plugins",
+			Description: "View and configure plugins",
+			Icon:        "gicon gicon-plugins",
+			Url:         setting.AppSubUrl + "/plugins",
+		})
+
 		configNodes = append(configNodes, &dtos.NavLink{
 			Text:        "Preferences",
 			Id:          "org-settings",
@@ -322,15 +322,17 @@ func (hs *HTTPServer) setIndexViewData(c *models.ReqContext) (*dtos.IndexViewDat
 		})
 	}
 
-	data.NavTree = append(data.NavTree, &dtos.NavLink{
-		Id:         "cfg",
-		Text:       "Configuration",
-		SubTitle:   "Organization: " + c.OrgName,
-		Icon:       "gicon gicon-cog",
-		Url:        configNodes[0].Url,
-		SortWeight: dtos.WeightConfig,
-		Children:   configNodes,
-	})
+	if len(configNodes) > 0 {
+		data.NavTree = append(data.NavTree, &dtos.NavLink{
+			Id:         "cfg",
+			Text:       "Configuration",
+			SubTitle:   "Organization: " + c.OrgName,
+			Icon:       "gicon gicon-cog",
+			Url:        configNodes[0].Url,
+			SortWeight: dtos.WeightConfig,
+			Children:   configNodes,
+		})
+	}
 
 	if c.IsGrafanaAdmin {
 		adminNavLinks := []*dtos.NavLink{
diff --git a/pkg/api/plugins.go b/pkg/api/plugins.go
index 108a267a6bc..950cdadf55e 100644
--- a/pkg/api/plugins.go
+++ b/pkg/api/plugins.go
@@ -57,6 +57,11 @@ func (hs *HTTPServer) GetPluginList(c *models.ReqContext) Response {
 	embeddedFilter := c.Query("embedded")
 	coreFilter := c.Query("core")
 
+	// For users with viewer role we only return core plugins
+	if !c.HasRole(models.ROLE_ADMIN) {
+		coreFilter = "1"
+	}
+
 	pluginSettingsMap, err := plugins.GetPluginSettings(c.OrgId)
 
 	if err != nil {
@@ -71,7 +76,7 @@ func (hs *HTTPServer) GetPluginList(c *models.ReqContext) Response {
 		}
 
 		// filter out core plugins
-		if coreFilter == "0" && pluginDef.IsCorePlugin {
+		if (coreFilter == "0" && pluginDef.IsCorePlugin) || (coreFilter == "1" && !pluginDef.IsCorePlugin) {
 			continue
 		}