Plugins: Hide plugins page from viewers, and limit /api/plugins to only core plugins when called by viewer role (#21901)

* Hide plugins list from viewers

* Made /api/plugins only return core plugins for users with viewer role

Co-authored-by: Torkel Ödegaard <torkel@grafana.com>

pkg/api/plugins.go

@@ -57,6 +57,11 @@ func (hs *HTTPServer) GetPluginList(c *models.ReqContext) Response {
 	embeddedFilter := c.Query("embedded")
 	coreFilter := c.Query("core")
 
+	// For users with viewer role we only return core plugins
+	if !c.HasRole(models.ROLE_ADMIN) {
+		coreFilter = "1"
+	}
+
 	pluginSettingsMap, err := plugins.GetPluginSettings(c.OrgId)
 
 	if err != nil {
@@ -71,7 +76,7 @@ func (hs *HTTPServer) GetPluginList(c *models.ReqContext) Response {
 		}
 
 		// filter out core plugins
-		if coreFilter == "0" && pluginDef.IsCorePlugin {
+		if (coreFilter == "0" && pluginDef.IsCorePlugin) || (coreFilter == "1" && !pluginDef.IsCorePlugin) {
 			continue
 		}