* remove support for v1
(cherry picked from commit 8630a7a991af74edc4030f57d37a4bc263202fde)
* Security: Make proxy endpoints not leak sensitive HTTP headers
Fixes CVE-2022-31130
(cherry picked from commit 2974574a53ab6d26be7b706e76271173a91fea3a)
* Security: Fix do not forward login cookie in outgoing requests
(cherry picked from commit 54a32fc83b233f5910495b5fcca0b4f881221538)
* Add test for username/login field conflict
(cherry picked from commit 7aabcf2694)
* Swap order of login fields
(cherry picked from commit 5ec176cada)
* "Release: Updated versions in package to 8.5.14" (#547)
Co-authored-by: Will Browne <will.browne@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
Co-authored-by: Grot (@grafanabot) <43478413+grafanabot@users.noreply.github.com>
* Chore: remove bus from contexthandler
* remove bus from orgredirect
(cherry picked from commit 2cf88cfec8)
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
* Chore: Remove bus from contexthandler
* fix tests
* try different wire binding
* maybe remove a few more dispatches
* fix tests
(cherry picked from commit d153d896c5)
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
* Auth: Do not search for the user twice
Previously `initContextWithBasicAuth` did not use `LoginUserQuery`, doing
`GetUserByLoginQuery` only i.e. looking user in DB only, things changed when
this function started to check LDAP provider via `LoginUserQuery` (#6940),
however, this request was placed after `GetUserByLoginQuery`, so we first
looking in DB then in the LDAP - if LDAP user hasn't logged in we will
not find it in DB, so `LoginUserQuery` will never be reached.
`LoginUserQuery` request already performs `GetUserByLoginQuery`
request in correct sequence. So we can just remove redundant request.
* Correct sequence execution during authentification &
introduce tests for it
* Move basic auth tests to separate test file, since main test file already
pretty large
* Introduce `testing.go` for the middleware module
* Remove redundant test helper function
* Make handler names more explicit
Ref 5777f65d05Fixes#18329
* Auth: address review comment
Sofia Papagiannaki
Serge Zaitsev
Grot (@grafanabot)
idafurjes
Carl Bergquist
Arve Knudsen
Oleg Gaidarenko