Commit Graph
4071 Commits
Author SHA1 Message Date
Marcus Efraimsson 9da278c044 Plugins: Make proxy endpoints not leak sensitive HTTP headers
Fixes CVE-2022-31130

(cherry picked from commit 40b319d3d6a9945c05709ce8d4679407f6ccadf0)
2022-10-11 13:04:37 +03:00
Grot (@grafanabot)andGabriel MABILLE c4e6e05687 FIX: Remove RBAC datasource permissions upon datasource deletion (#56530) (#56549)
* FIX: Remove RBAC datasource permissions upon datasource deletion

* Use scope provider instead

* Fix test

(cherry picked from commit 7595ed0668)

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2022-10-11 12:16:26 +03:00
Joe Blubaugh 7e2e76aa90 [v9.1.x] Alerting: Mark all tests that interact with the database as Integration tests. (#56604)
Previously, two tests were not explicitly marked as integration tests
and so were not run against all 3 supported databases in the CI
environment.

(cherry picked from commit 7312a2dab0)
2022-10-11 10:04:05 +01:00
Grot (@grafanabot)andYuriy Tseretyan c1cf22beaf Alerting: Fix migration to create rules with group index 1 (#56511) (#56583)
(cherry picked from commit 3487e68d15)

Co-authored-by: Yuriy Tseretyan <yuriy.tseretyan@grafana.com>
2022-10-07 17:31:55 -04:00
Yuriy Tseretyan 7c1f70af4f [9.1.x] Alerting: Fix migration to not add label "alertname" (#56509) (#56580) 2022-10-07 20:38:54 +00:00
Grot (@grafanabot)andGeorge Robinson 702bdb9c5f Alerting: Fix pq: missing FROM-clause for table "a" (#56453) (#56533)
This commit fixes a bug where changing the Folder or Rule Group of an existing rule returns the following error in PostgreSQL "pq: missing FROM-clause for table a"

(cherry picked from commit 762688d67f)

Co-authored-by: George Robinson <george.robinson@grafana.com>
2022-10-07 10:35:43 +01:00
Joe Blubaugh 42b8c446d7 Alerting: Update imported prometheus alertmanager version. Backport (#56228) (#56429)
* Alerting: Update imported prometheus alertmanager version. (#56228)

Version 0.24.0 has a few bugs that cause panics. We update here to the
latest commit on github.com/prometheus/alertmanager's main branch.

Panic Bugs:
https://github.com/prometheus/alertmanager/issues/2936
https://github.com/prometheus/alertmanager/issues/3064

(cherry picked from commit ce89624ca2)
2022-10-07 14:01:15 +08:00
Grot (@grafanabot)andJean-Philippe Quéméner b0ef776ed8 Alerting: make sure that rules in rule group are nil if not provided (#55301) (#55324)
(cherry picked from commit 4dc0d49025)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-10-04 04:50:02 -04:00
Emil Tullstedt 05b4ce4861 Chore: Upgrade Go version to 1.19.1 (backport) (#55733)
Upgrades the version of Go used to build Grafana v9.1.x to 1.19.1.

Backport of Chore: Upgrade Go to 1.19.1 #54902
Backport of Chore: Update swagger to v0.30.2 #55159
2022-09-28 10:58:56 +02:00
Gabriel MABILLE f6365646a7 Fix: RBAC handle error no resolver found (#55676)
* Fix: Handle error no resolver found

* Fix test not to expect the error
2022-09-27 09:43:50 +02:00
Grot (@grafanabot)andJean-Philippe Quéméner fbf3fe69b5 Alerting: cache general folder in migration based on org id (#55620) (#55691)
(cherry picked from commit f3a307778a)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-09-23 22:25:36 +02:00
Grot (@grafanabot)andJean-Philippe Quéméner 936b3d8327 Alerting: support env variables in contact point settings when provsioning (#55666) (#55680)
(cherry picked from commit 0f2afb6417)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-09-23 09:22:19 -04:00
Grot (@grafanabot)andEmil Tullstedt c3275d23ff Alerting: Fix flaky test (#55551) (#55673)
The length of the identifier from the underlying library is 9 or more characters depending on the rate at which the identifiers are generated. See https://pkg.go.dev/github.com/teris-io/shortid

The test previously made the assumption that the length will always be 10, which would intermittently fail.

(cherry picked from commit 647997cc4c)

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
2022-09-23 13:36:45 +02:00
Artur Wierzbicki 98eab48d38 Search: Add search index configuration options (#55525) (#55529)
* Search: Add search index configuration options (#55525)

* Search: externalize config

* Search: update config descriptions

* Search: fix value

* Search: fix

* update

* Search: revert config values

* Search: rename copy/paste

* Search: fix tests

(cherry picked from commit c3ca5405ce)

* fix merge
2022-09-22 15:26:37 +02:00
Grot (@grafanabot)andJean-Philippe Quéméner 97bee8a53a Alerting: Skip unsupported file types on provisioning (#55573) (#55584)
(cherry picked from commit 74c66b29d0)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-09-21 11:04:17 -04:00
Grot (@grafanabot)andArtur Wierzbicki 3303eb7881 Search: improve logging in case of failed dashboard loading phase (#55523) (#55524)
(cherry picked from commit 9db2720016)

Co-authored-by: Artur Wierzbicki <wierzbicki.artur.94@gmail.com>
2022-09-20 18:08:21 -04:00
Ieva d9a39c1553 V9.1.3.1 security patch (#492) (#55515)
* apply security fix for admin only folder migration (#482)

* Data source: prevent from using auth proxy header as custom data source header (#474)

* applying changes from 446/fix-user-escalation-through-auth-proxy

* linting

* only validate custom headers if auth proxy is enabled

* import ordering

* add links to CVE

* clean up

* remove typo

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
(cherry picked from commit 0100a6aa9645313b25a79a17d947cbf936cc4e76)
(cherry picked from commit c048378ad5)
2022-09-20 14:57:15 -04:00
Grot (@grafanabot)andMichael Musenbrock 946622f7c6 Provisioning Contact points: Support disableResolveMessage via YAML too (#54122) (#55254)
Signed-off-by: Michael Musenbrock <michael.musenbrock@gmail.com>
(cherry picked from commit 099d3cdf72)

Co-authored-by: Michael Musenbrock <michael.musenbrock@gmail.com>
2022-09-15 16:53:00 -05:00
Grot (@grafanabot)andGeorge Robinson b0124f0648 Alerting: Fix send resolved notifications (#54793) (#55256)
This commit fixes a bug where we did not send resolved alerts to Alertmanager for resolved alert instances. This meant that resolved notifications did not have the annotations from the resolved state, and a result did not also have the resolved screenshot.

(cherry picked from commit 5561f935e6)

Co-authored-by: George Robinson <george.robinson@grafana.com>
2022-09-15 19:55:01 +01:00
Eric Leijonmarck f500459303 [v9.1.x] fix: min metric to hourly metric (#55244)
* fixed merge

* fixed merge

* fixed merge
2022-09-15 16:21:59 +02:00
Grot (@grafanabot)andPiotr Jamróz 1c9091f85d Migrate user_id to BIGINT (#55084) (#55235)
(cherry picked from commit 7352c181c2)

Co-authored-by: Piotr Jamróz <pm.jamroz@gmail.com>
2022-09-15 14:46:21 +02:00
Grot (@grafanabot)andAlexander Weaver 3425aace85 Alerting: Fix legacy migration crash when rule name is too long (#55053) (#55128)
* Extract standardized UID field length to constant

* Extract default length to constant

* Truncate rule names that are too long

* Add tests for name normalization

* Fix whitespace lint error

* Another linter fix

* Empty commit to kick build

(cherry picked from commit 9f45e2e706)

Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2022-09-13 15:12:16 -04:00
Grot (@grafanabot)andJean-Philippe Quéméner f80a9388cf Alerting: remove interpolation of annotations from alert rule file provisioning (#54975) (#54996)
(cherry picked from commit bc4d929c67)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-09-12 11:01:03 +02:00
Artur Wierzbicki e1f5d698e6 Search: Add substring matcher (#54895)
* Search: Add substring matcher (#54813)

* search: bring back substring search

* lint fix

* search: bring back ngram

* search: bring back ngram

* search: more tests

* fix tests
2022-09-09 14:20:20 +02:00
Jean-Philippe Quéméner 19a58da54c Alerting: make sure to update contact point references when updating (#54896) (#54952)
(cherry picked from commit e41f78a56d)
2022-09-09 14:15:57 +02:00
Grot (@grafanabot)andJean-Philippe Quéméner c4f57481fd Alerting: validate am config changes before persisting (#54908) (#54944)
(cherry picked from commit d88f1c8e35)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-09-09 04:53:02 -04:00
Grot (@grafanabot)andCarl Bergquist ed52d422c1 instrumentation: dont instrument ErrSkip at all (#54880) (#54883)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
(cherry picked from commit b4e3c89f60)

Co-authored-by: Carl Bergquist <carl.bergquist@gmail.com>
2022-09-08 05:27:38 -04:00
Grot (@grafanabot)andMatthew Jacobson 1bf8c8563d Alerting: Sanitize invalid label/annotation names for external alertmanagers (#54537) (#54859)
* Alerting: Sanitize invalid label/annotation names for external alertmanagers

Grafana's built-in Alertmanager supports both Unicode label keys and values; however, if using an external
Prometheus Alertmanager label keys must be compatible with their data model.
This means label keys must only contain ASCII letters, numbers, as well as underscores and match the regex
`[a-zA-Z_][a-zA-Z0-9_]*`.

Any invalid characters will now be removed or replaced by the Grafana alerting engine before being sent to
the external Alertmanager according to the following rules:

- `Whitespace` will be removed.
- `ASCII characters` will be replaced with `_`.
- `All other characters` will be replaced with their lower-case hex representation.

* Prefix hex replacements with `0x`

* Refactor for clarity

* Apply suggestions from code review

Co-authored-by: brendamuir <100768211+brendamuir@users.noreply.github.com>

Co-authored-by: brendamuir <100768211+brendamuir@users.noreply.github.com>
(cherry picked from commit 940d18ad57)

Co-authored-by: Matthew Jacobson <matthew.jacobson@grafana.com>
2022-09-07 11:52:00 -04:00
Grot (@grafanabot)andAlexander Weaver 48ee6e6cb8 Alerting: Resetting the notification policy tree to the default policy will also restore default contact points (#54608) (#54855)
* Add test that resetting the route restores the default receiver

* Return error instead of panic

* Adjust error string to match styleguide

(cherry picked from commit b193eaed6e)

Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2022-09-07 10:46:32 -05:00
Grot (@grafanabot)andAlexander Weaver 9c3e1968da [v9.1.x] Alerting: Fix incorrect propagation of org ID and other fields in rule provisioning endpoints (#54807)
* Fix incorrect propagation of org ID in rule endpionts (#54603)

(cherry picked from commit b8d1474609)

* Work around OrgId -> OrgID rename in backport

Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2022-09-06 15:20:15 -05:00
Grot (@grafanabot)andIlya Galimyanov 35d51435f4 Alerting: Telegram: truncate long messages (#54339) (#54796)
Truncate messages longer than 4096 characters

(cherry picked from commit b593d371ef)

Co-authored-by: Ilya Galimyanov <ilyaxa1@gmail.com>
2022-09-06 18:29:18 +01:00
Karl Persson 843ca0a355 [v9.1.x] RBAC: Fix resolver issue on wildcard resulting in wrong status code (#54692)
* RBAC: Fix resolver issue on wildcard resulting in wrong status code for endpoints (#54208)

* RBAC: Test evaluation before attaching mutator

* RBAC: Return error if no resolver is found for scope

* RBAC: Sync changes to evaluation in mock

* RBAC: Check for resolver not found error and just fail the evaluation in that case

(cherry picked from commit 552d3fec8d)
2022-09-06 09:08:49 +02:00
Grot (@grafanabot)andkay delaney 6f255cb089 LibraryElements: Fix inability to delete library panels under MySQL (#54600) (#54711)
Closes #53456

(cherry picked from commit 65c3ad6721)

Co-authored-by: kay delaney <45561153+kaydelaney@users.noreply.github.com>
2022-09-05 10:29:56 -04:00
Carl Bergquist 8790142aef Instrumentation: log the total number of db queries per request (#54647) (#54686)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
(cherry picked from commit 78978048c3)
2022-09-05 11:58:35 +02:00
Karl Persson 8526d2cb71 Correlations: Use correct fallback handlers (#54511) (#54569)
* Correlations: Use correct fallback handlers

* Add signed in middleware to all routes

(cherry picked from commit be6b8d91eb)
2022-09-01 15:08:10 +02:00
Dave Henderson 74734db443 [v9.1.x] Metrics: Fixed grafana_database_conn_* metrics, and added new go_sql_stats_* metrics as eventual replacement (#54540)
Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2022-08-31 11:32:29 -04:00
Grot (@grafanabot)andJoan López de la Franca Beltran e5741c82d6 Rendering: Add support for renderer token (#54425) (#54431)
(cherry picked from commit a4f75cc0438712c90b02d24740416f8615e3a0cb)
(cherry picked from commit 6ec06f66b9)

Co-authored-by: Joan López de la Franca Beltran <5459617+joanlopez@users.noreply.github.com>
2022-08-30 11:32:29 +01:00
Grot (@grafanabot)andKarl Persson 493c7866a2 RBAC: Display indicator if a permission is inherited (#54080) (#54380)
* RBAC: Add IsInherited property

* PermissionList: Display inherited indicator

(cherry picked from commit cc78486535)

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2022-08-29 05:29:37 -04:00
Marcus Efraimsson c8a313c289 Plugins: Remove various custom headers logic (#54146) (#54284)
Removes various custom headers logic sprinkled around in the backend.
It should automatically be applied to outgoing HTTP requests via the
CustomHeadersMiddleware.
This also removes decryption of SecureJSONData to populate custom
headers in ngalert which seemed to have caused a ton of CPU usage.

(cherry picked from commit 87afd9cadc)
2022-08-29 10:21:34 +02:00
Grot (@grafanabot)andJean-Philippe Quéméner 200a901829 Alerting: use raw query data in provisioning to bypass interpolation of macros (#54293) (#54357)
(cherry picked from commit a932428057)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-08-26 18:07:47 -04:00
Grot (@grafanabot)andJean-Philippe Quéméner 867c695646 Alerting: add missing yaml tag to mute time struct (#54287) (#54355)
(cherry picked from commit 49b1182f34)

Co-authored-by: Jean-Philippe Quéméner <JohnnyQQQQ@users.noreply.github.com>
2022-08-26 17:41:51 -04:00
Artur Wierzbicki 108c2575f8 Search: use SQL search as a fallback during bluge's initial indexing (#54095) (#54276)
* Search: use SQL search as a fallback when bluge indexing is ongoing

* Search: lint

* Search: feedback fixes - return an empty frame with a special name

* Search: revert readiness check query type

* Search: remove println

* remove sleep, get coffee

(cherry picked from commit 74158ed66b)
2022-08-26 08:38:15 -07:00
George RobinsonandValério Valério d941d0ba78 Alerting: Fix saving of screenshots uploaded with a signed url (#53933) (#54147)
The URL of screenshots uploaded to external image storages can be optionally signed, resulting in a long string (800+ chars).

Co-authored-by: Valério Valério <vdv100@gmail.com>
2022-08-25 09:06:59 +01:00
Yuriy Tseretyan 04967f4d8a Alerting: Update rules delete endpoint to handle rules in group (#53790) (#54184)
* update RouteDeleteAlertRules rules to update as a group
* remove expecter from scheduler mock to support variadic function
* create function to check for provisioning status + tests
2022-08-24 16:51:26 -04:00
Grot (@grafanabot)andSantiago 7002c11006 Alerting: log external alertmanager URLs #54127 (#54177)
(cherry picked from commit 4fad827acd)

Co-authored-by: Santiago <santiagohernandez.1997@gmail.com>
2022-08-24 14:08:34 -04:00
Grot (@grafanabot)andGeorge Robinson f80df9a187 [v9.1.x] Alerting: Fix width of Adaptive Cards in Teams notifications (#54045)
Co-authored-by: George Robinson <george.robinson@grafana.com>
2022-08-22 17:18:08 +02:00
Grot (@grafanabot)andGeorge Robinson 85ef08283f Alerting: Fix links in Microsoft Teams notifications (#54003) (#54012)
(cherry picked from commit c960301aa8)

Co-authored-by: George Robinson <george.robinson@grafana.com>
2022-08-22 11:31:34 +01:00
Grot (@grafanabot)andGeorge Robinson f6d7731dc1 Alerting: Fix notifications for Microsoft Teams (#53810) (#53843)
This commit fixes notifications for Microsoft Teams where notifications
would just contain "Card" rather than the title.

(cherry picked from commit 6d69d7acb8)

Co-authored-by: George Robinson <george.robinson@grafana.com>
2022-08-17 17:01:47 +01:00
Alexander Weaver 98a36f4005 Alerting: Fix incorrect embedded DTO being returned when handling rule groups (#53702)
* Alerting: Fix incorrect embedded DTO being returned when handling rule groups (#53701)

* Fix DTO embedding when getting/putting alert rule groups

* Drop usage of word 'Domain'

* Rename var as well

(cherry picked from commit f093c249ac)

* Actually fix two casing problems
2022-08-12 17:54:35 -04:00
Grot (@grafanabot)andAlexander Weaver 29ac9e8e58 Fix order-of-magnitude bug in DTO conversion (#53690) (#53696)
(cherry picked from commit ccd41df603)

Co-authored-by: Alexander Weaver <weaver.alex.d@gmail.com>
2022-08-12 16:21:15 -04:00