Compare commits

...

4 Commits

Author SHA1 Message Date
Stephanie Hingtgen
bb93ae3e12 APIs: Remove dashboard and folder registration 2025-04-07 09:28:32 -05:00
nmarrs
5dbaf8355c backport change 2025-04-07 09:28:32 -05:00
Yuri Tseretyan
341e2b8510 require editor to fetch config 2025-04-07 09:28:32 -05:00
Andres Martinez Gotor
89963aca1f Sanitize paths before evaluating access to route 2025-04-07 09:28:32 -05:00
6 changed files with 26 additions and 10 deletions

View File

@@ -302,7 +302,15 @@ func (proxy *DataSourceProxy) validateRequest() error {
}
// route match
if !strings.HasPrefix(proxy.proxyPath, route.Path) {
r1, err := util.CleanRelativePath(proxy.proxyPath)
if err != nil {
return err
}
r2, err := util.CleanRelativePath(route.Path)
if err != nil {
return err
}
if !strings.HasPrefix(r1, r2) {
continue
}

View File

@@ -274,6 +274,14 @@ func TestDataSourceProxy_routeRule(t *testing.T) {
err = proxy.validateRequest()
require.NoError(t, err)
})
t.Run("path with slashes and user is editor", func(t *testing.T) {
ctx, _ := setUp()
proxy, err := setupDSProxyTest(t, ctx, ds, routes, "//api//admin")
require.NoError(t, err)
err = proxy.validateRequest()
require.Error(t, err)
})
})
t.Run("plugin route with RBAC protection user is allowed", func(t *testing.T) {

View File

@@ -30,17 +30,13 @@ import (
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/registry/apis/dashboard/legacy"
"github.com/grafana/grafana/pkg/registry/apis/dashboard/legacysearcher"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/apiserver/builder"
"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
"github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/services/provisioning"
"github.com/grafana/grafana/pkg/services/search/sort"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/storage/legacysql"
"github.com/grafana/grafana/pkg/storage/legacysql/dualwrite"
"github.com/grafana/grafana/pkg/storage/unified/apistore"
"github.com/grafana/grafana/pkg/storage/unified/resource"
@@ -85,7 +81,8 @@ func RegisterAPIService(
dual dualwrite.Service,
sorter sort.Service,
) *DashboardsAPIBuilder {
softDelete := features.IsEnabledGlobally(featuremgmt.FlagDashboardRestore)
// disable dashboard api in 11.6
/* softDelete := features.IsEnabledGlobally(featuremgmt.FlagDashboardRestore)
dbp := legacysql.NewDatabaseProvider(sql)
namespacer := request.GetNamespaceMapper(cfg)
legacyDashboardSearcher := legacysearcher.NewDashboardSearchClient(dashStore, sorter)
@@ -105,7 +102,8 @@ func RegisterAPIService(
reg: reg,
}
apiregistration.RegisterAPI(builder)
return builder
return builder*/
return nil
}
func (b *DashboardsAPIBuilder) GetGroupVersions() []schema.GroupVersion {

View File

@@ -67,7 +67,8 @@ func RegisterAPIService(cfg *setting.Cfg,
registerer prometheus.Registerer,
unified resource.ResourceClient,
) *FolderAPIBuilder {
if !featuremgmt.AnyEnabled(features,
// disable api in 11.6
if true || !featuremgmt.AnyEnabled(features,
featuremgmt.FlagKubernetesClientDashboardsFolders,
featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs,
featuremgmt.FlagProvisioning) {

View File

@@ -39,7 +39,7 @@
{
"method": "GET",
"path": "api/v1/alerts",
"reqRole": "Admin"
"reqRole": "Editor"
}
],
"info": {

View File

@@ -641,7 +641,8 @@ function fieldValueColors(f: Field, theme: GrafanaTheme2): FieldColorValues {
let lasti = steps.length - 1;
for (let i = lasti; i > 0; i--) {
conds += `v >= ${steps[i].value} ? ${i} : `;
let rhs = Number(steps[i].value);
conds += `v >= ${rhs} ? ${i} : `;
}
conds += '0';