* Security: Make proxy endpoints not leak sensitive HTTP headers
Fixes CVE-2022-31130
* remove support for v1 manifests
* Security: Fix do not forward login cookie in outgoing requests
Co-authored-by: Will Browne <will.browne@grafana.com>
* Data source: prevent from using auth proxy header as custom data source header (#478)
* apply security changes for auth proxy permission escalation
* fix test
* fix test
* add links to CVE
* remove duplicate check
* apply security fix for admin only folder migration (#483)
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* API: Fix snapshot responses (#52998)
* API: Fix response status when snapshots are not found
* API: Fix response status when snapshot key is empty
* Apply suggestions from code review
(cherry picked from commit 5fec6cc4f5)
* update decrypt secrets function signature and add secrets error handling
* remove a couple instances of unnecessary logging since errors are properly handled now
* add unit test
* fix linting issues
(cherry picked from commit 9aa6ce2a50)
Co-authored-by: Michael Mandrus <41969079+mmandrus@users.noreply.github.com>
* WIP: Fix XSS in runbook URL (#378)
(cherry picked from commit f4a8d96a4e1259ea25d9cc702a652f1b819db236)
(cherry picked from commit 337c08507b2b1c78ea470192d34cf611fae4b5da)
(cherry picked from commit 54b36a07406ed4e26ff8e161e50eda5401f504da)
* Update grabpl version
(cherry picked from commit b253e87d730f7b8aabdd0b328c5e7a82547c43b3)
(cherry picked from commit 080d3e46f3fcd61555795b9fe8fd6ee2492b422a)
* Fix: Choose Lookup params per auth module
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Fix: Prefer pointer to struct in lookup
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Fix: user email for ldap
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Fix: Use only login for lookup in LDAP
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Fix: use user email for ldap
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
fix remaining test
fix nit picks
(cherry picked from commit 1eca4aeed878853743cebcf9790b05dd350c4f83)
(cherry picked from commit 0777d100e9263d08f51dbac71aee0766c8a85a92)
* remove better (broke the pipeline)
Co-authored-by: George Robinson <george.robinson@grafana.com>
Co-authored-by: dsotirakis <sotirakis.dim@gmail.com>
Co-authored-by: jguer <joao.guerreiro@grafana.com>
/api/admin/pause-all-alerts only takes effect for legacy alerts. This
change returns a 403 if it's called when legacy alerting is disabled.
Fixes#51729
(cherry picked from commit 0cbc14961a)
Co-authored-by: Joe Blubaugh <joe.blubaugh@grafana.com>
* Plugins: Register management endpoints only when external managed is also false (#51802)
* Only define plugin install endpoints when catalog enabled
* add external check
(cherry picked from commit 40dff288cd)
* fix test
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
Co-authored-by: Will Browne <will.browne@grafana.com>
* Chore: Remove global bus variable (#50765)
* Chore: Remove global bus variable
* fix bus in tests
(cherry picked from commit 0b55c41d05)
* fix the imports
* Bug: Fix delete dashboard snapshot for deleted dashboards
* Fix lint and make it work for all the errors
* Fix lint
(cherry picked from commit 8ab8ce609b)
Co-authored-by: idafurjes <36131195+idafurjes@users.noreply.github.com>
* backend/api: refactor PlaylistId to PlaylistUid
* Add org_id to Get and Update playlist functions
Fix migration - no longer pad the uid; fix mysql syntax
The relevant tests are passing using postgres, mysql and the default sqllite backends, but there are a number of other failing tests when using postgres and myself so I'm not entirely confident with those results.
* fix bad query in GetPlaylistItem and add a test that would have caught the mistake in the first place. Reverted the playlist_uid column addition in playlist_item; it became unnecessary after this PR.
Added default value to the new UID column based on PR feedback.
* break this PRs migration into its own function
* Playlists: Update UI to use the updated API
Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
(cherry picked from commit a33a023629)
Co-authored-by: Kristin Laemmert <mildwonkey@users.noreply.github.com>
* OAuth: Redirect to login if no oauth module is found or if module is not
configured
* OAuth: Update test to check for location header
(cherry picked from commit 95a4c4a4d6)
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* update action names
* correctly retrieve teams for signed in user
* remove test
* undo swagger changes
* undo swagger changes pt2
* add migration from old action names to the new ones
* rename from list to read
* linting
* also update alertign actions
* fix migration
(cherry picked from commit 5dbea9996b)
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
* remove /api/tsdb/query
* revert changes to alert rules
* regenerate spec based on 9.0.x
(cherry picked from commit abfc711c53)
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
* Preferences: Fix PUT for Navbar and Query History
* Update linting
* Fix linting
* Use models defined in preference package in preferences
* Remove white space
* Revert "Use models defined in preference package in preferences"
This reverts commit 6f7aa9f8d3.
(cherry picked from commit e25a49ff49)
Co-authored-by: Ivana Huckova <30407135+ivanahuckova@users.noreply.github.com>
* grant data source reader to all users when running oss or enterprise
without license
* fix asserts in alerting tests
* add oss licensing service for test setup
* fix tests to pass in enterprise
* lint
* fix tests
* set setting.IsEnterprise flag for tests
Co-authored-by: Yuriy Tseretyan <yuriy.tseretyan@grafana.com>
(cherry picked from commit 1796a1d277)
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* switch saved items to starred items
* hook up redux properly
* Better query + hook up DashList
* update initial state so it's never undefined
* update GetDashboard call
* use new star service
* add scroll + maxwidth to navbar hover menu, sort starred items alphabetically
* increase height, revert changes to CustomScrollbar
* ellipsis!
* update starred dashboard name in navtree
* sort after renaming
* limit to first 50 starred dashboards found
* chore: replace handmade FakeDashboardService with generated mock
Maintaining a handcrafted FakeDashboardService is not sustainable now that we are in the process of moving the dashboard-related functions out of sqlstore.
* remove dialect global variable
* Add database migrations
* Use short uids as data key ids
* Add support for manual data key rotation
* Fix duplicated mutex unlocks
* Fix migration
* Manage current data keys per name
* Adjust key re-encryption and test
* Modify rename column migration for MySQL compatibility
* Refactor secrets manager and data keys cache
* Multiple o11y adjustments
* Fix stats query
* Apply suggestions from code review
Co-authored-by: Tania <yalyna.ts@gmail.com>
* Fix linter
* Docs: Rotate data encryption keys API endpoint
Co-authored-by: Tania <yalyna.ts@gmail.com>
