IevaandKarl Persson 0a52f1bdf6 V9.0.8.1 security patch (#491) (#55498) ...

* Data source: prevent from using auth proxy header as custom data source header (#478)

* apply security changes for auth proxy permission escalation

* fix test

* fix test

* add links to CVE

* remove duplicate check

* apply security fix for admin only folder migration (#483)

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

2022-09-20 11:48:40 -04:00

..

accesscontrol

RBAC: Display indicator if a permission is inherited (#54080) (#54381)

2022-08-29 05:48:00 -04:00

alerting

Alerting: Validate alert notification UID length (#45546) (#49513)

2022-05-24 17:21:27 +02:00

annotations

Chore : Replace dashboardid with dashboardUID in annotation API (#48481)

2022-05-02 11:35:36 +02:00

auth

Chore: Remove context.TODO() (#43409)

2021-12-22 11:02:42 +01:00

cleanup

Query history: Cleanup (#48303)

2022-05-03 14:49:58 +02:00

comments

backend/services: Move GetDashboard from sqlstore to dashboard service (#48971)

2022-05-17 14:52:22 -04:00

contexthandler

Security: Fixes for CVE-2022-31107 and CVE-2022-31097 (#52279)

2022-07-14 14:56:53 -05:00

dashboardimport

Export: Fix export/import of dash with library panels (#49319) (#51760)

2022-07-14 11:17:12 +01:00

dashboards

Fix anonymous access (#52615) (#52636)

2022-07-22 11:09:05 +02:00

dashboardsnapshots

Chore: Remove x from dashboard snapshots (#48001)

2022-04-21 08:20:47 -04:00

datasourceproxy

add missing return (#50667) (#50675)

2022-06-13 14:27:45 +02:00

datasources

V9.0.8.1 security patch (#491) (#55498)

2022-09-20 11:48:40 -04:00

encryption

Encryption: Add support for decrypting ciphertexts with algorithm metadata (#49312)

2022-05-20 17:11:51 +02:00

export

Export: introduce export plumbing (behind dev feature flag) (#48091)

2022-04-25 16:59:18 -07:00

featuremgmt

[v9.0.x] Traces: Remove serviceMap feature flag (#52433)

2022-07-19 10:25:12 +01:00

guardian

RBAC: Make RBAC action names more consistent (#49730) (#50083)

2022-06-02 15:15:40 +02:00

hooks

Migrate to Wire for dependency injection (#32289)

2021-08-25 15:11:22 +02:00

kmsproviders

Encryption: Enable envelope encryption by default (#49301)

2022-05-24 10:34:47 +02:00

ldap

pkg/web: restrict handler types (#48495)

2022-05-20 12:45:18 -04:00

libraryelements

LibraryPanels: Rewrite invalid connection deletion query to be MySQL-friendly (#53460) (#53468)

2022-08-09 15:37:03 +01:00

librarypanels

Export: Fix export/import of dash with library panels (#49319) (#51760)

2022-07-14 11:17:12 +01:00

licensing

RBAC: Make RBAC action names more consistent (#49730) (#50083)

2022-06-02 15:15:40 +02:00

live

rm debug log when publishing live message (#50774) (#50779)

2022-06-14 14:27:11 +02:00

login

[v9.0.x] Auth: Add prometheus metrics for case insensitive ids (#52634)

2022-07-22 12:06:02 +01:00

multildap

pkg/web: restrict handler types (#48495)

2022-05-20 12:45:18 -04:00

ngalert

V9.0.8.1 security patch (#491) (#55498)

2022-09-20 11:48:40 -04:00

notifications

Alerting: Fix Teams notifier not failing on 200 response with error (#52254) (#52260)

2022-07-14 13:38:21 -04:00

oauthtoken

Chore: Remove bus from oauthtoken (#46811)

2022-03-21 21:13:57 +01:00

plugindashboards

[v9.0.x] Chore: Remove global bus variable (#51126)

2022-06-21 11:40:44 +02:00

pluginsettings

Plugins: Add plugin settings DTO (#46283)

2022-03-18 20:49:13 +01:00

preference

Chore: Rename integration tests (#49438)

2022-05-24 11:04:03 +02:00

provisioning

resolve conflicts (#50184)

2022-06-03 18:03:45 +02:00

query

V9.0.8.1 security patch (#491) (#55498)

2022-09-20 11:48:40 -04:00

queryhistory

Chore: Rename integration tests (#49438)

2022-05-24 11:04:03 +02:00

quota

Update quota service to accept context (#45186)

2022-02-10 22:17:50 +01:00

rendering

Rendering: Add support for renderer token (#54425) (#54439)

2022-08-30 14:05:18 +02:00

schemaloader

FeatureFlags: define features outside settings.Cfg (take 3) (#44443)

2022-01-26 09:44:20 -08:00

screenshot

Alerting: Better metrics and renamed BrowserScreenshotService (#51564) (#51649)

2022-06-30 18:36:20 +01:00

search

[v9.0.x] Search (SQL): support dashboardUID query parameter (#50126)

2022-06-02 18:10:29 -07:00

searchusers

Access control: Using RBAC to filter users in list view that you have read access to (#47963)

2022-05-13 09:26:34 +02:00

searchV2

Search: fix anonymous user access (#51045) (#51055)

2022-06-17 18:53:38 +02:00

secrets

Encryption: Re-order error check (#52251) (#52293)

2022-07-14 18:11:55 -04:00

serviceaccounts

clean up duplicated user creation code (#50178) (#50327)

2022-06-13 07:12:00 -04:00

shorturls

Migrate to Wire for dependency injection (#32289)

2021-08-25 15:11:22 +02:00

sqlstore

V9.0.8.1 security patch (#491) (#55498)

2022-09-20 11:48:40 -04:00

star

Chore: Rename integration tests (#49438)

2022-05-24 11:04:03 +02:00

store

SearchV2: instant local updates, folder events (#50001) (#50194)

2022-06-03 22:29:48 +02:00

teamguardian

ValidatedQueries: start of validated queries API (#44731)

2022-03-07 09:33:01 -09:00

thumbs

Previews: use ETag header (#51008) (#51041)

2022-06-17 16:16:24 +02:00

updatechecker

Logging: Unify logging fakes (#48822)

2022-05-06 17:44:22 +02:00

validations

Migrate to Wire for dependency injection (#32289)

2021-08-25 15:11:22 +02:00