From fce5a261442bd2cc32a5c7f08d69eb21fae3a02f Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Wed, 3 Apr 2024 14:16:50 +0100 Subject: [PATCH] [v11.0.x] RBAC: Fix access checks for interactions with RBAC roles in hosted Grafana (#85520) RBAC: Fix access checks for interactions with RBAC roles in hosted Grafana (#85485) * don't check global permissions for cloud instances * linting (cherry picked from commit beb15d938b0f3183a93c8a714a2c3c9c071c7a85) Co-authored-by: Ieva --- pkg/services/accesscontrol/middleware.go | 25 ++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/pkg/services/accesscontrol/middleware.go b/pkg/services/accesscontrol/middleware.go index ed79b13c604..bcc588fb4ae 100644 --- a/pkg/services/accesscontrol/middleware.go +++ b/pkg/services/accesscontrol/middleware.go @@ -338,18 +338,23 @@ func UseOrgFromRequestData(c *contextmodel.ReqContext) (int64, error) { } // UseGlobalOrgFromRequestData returns global org if `global` flag is set or the org where user is logged in. -func UseGlobalOrgFromRequestData(c *contextmodel.ReqContext) (int64, error) { - query, err := getOrgQueryFromRequest(c) - if err != nil { - // Special case of macaron handling invalid params - return NoOrgID, org.ErrOrgNotFound.Errorf("failed to get organization from context: %w", err) - } +// If RBACSingleOrganization is set, the org where user is logged in is returned - this is intended only for cloud workflows, where instances are limited to a single organization. +func UseGlobalOrgFromRequestData(cfg *setting.Cfg) func(*contextmodel.ReqContext) (int64, error) { + return func(c *contextmodel.ReqContext) (int64, error) { + query, err := getOrgQueryFromRequest(c) + if err != nil { + // Special case of macaron handling invalid params + return NoOrgID, org.ErrOrgNotFound.Errorf("failed to get organization from context: %w", err) + } - if query.Global { - return GlobalOrgID, nil - } + // We only check permissions in the global organization if we are not running a SingleOrganization setup + // That allows Organization Admins to modify global roles and make global assignments. + if query.Global && !cfg.RBACSingleOrganization { + return GlobalOrgID, nil + } - return c.SignedInUser.GetOrgID(), nil + return c.SignedInUser.GetOrgID(), nil + } } // UseGlobalOrgFromRequestParams returns global org if `global` flag is set or the org where user is logged in.