Ieva 3282afc648 V8.5.12 security patch (#486) (#55495) ...

* Data source: prevent from using auth proxy header as custom data source header (#477)

* apply security changes for auth proxy permission escalation

* add links to CVE

* remove duplicate check

* apply security fix for admin only folder migration (#484)

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

2022-09-20 16:40:52 +01:00

..

apierrors

Plugins: Refactor plugin dashboards (#44315)

2022-01-28 10:28:33 +01:00

avatar

Dashboard: Mix initials and custom gravatars in recent viewers list (#47212)

2022-04-05 22:56:17 -04:00

datasource

Check for empty URLs when creating/updating a data source (#42837)

2022-01-31 12:39:55 -03:00

docs

[v8.5.x] API: Fix snapshot responses (#53301)

2022-08-04 19:21:39 +03:00

dtos

Navigation: Show only + icons in overlay menu for new NavBar (#47347) (#47644)

2022-04-12 17:04:28 +03:00

frontendlogging

Logger migration from log15 to gokit/log (#41636)

2022-01-06 22:28:05 +08:00

navlinks

show admin nav link it the user only has permissions to view licensing and not other pages under admin node (#41948)

2021-11-19 11:02:13 +00:00

pluginproxy

Instrumentation: Proxy status code correction and various improvements (#47473) (#47903)

2022-04-19 20:41:57 +02:00

response

Tracing: Use common traceID context value for opentracing and opentelemetry (#46411) (#47786)

2022-04-14 18:08:51 +02:00

routing

Instrumentation: Fix HTTP request instrumentation of authentication failures (#44234)

2022-02-02 18:48:46 +01:00

static

API: Extract OpenAPI specification from source code using go-swagger (#40528)

2022-02-08 13:38:43 +01:00

accesscontrol.go

backport (#51964)

2022-07-08 16:28:41 +02:00

admin_provisioning_test.go

Chore: Add context to org (#40685)

2021-11-03 11:31:56 +01:00

admin_provisioning.go

Chore: Remove Dispatch and AddHandler (#42603)

2021-12-02 18:08:59 +01:00

admin_test.go

Chore: Remove bus from admin (#44920)

2022-02-04 17:53:58 +01:00

admin_users_test.go

Chore: Remove bus.Bus field (#47695) (#47704)

2022-04-13 19:11:20 +02:00

admin_users.go

Chore: Remove bus from admin users (#44869)

2022-02-04 13:45:42 -05:00

admin.go

Chore: Remove bus from admin (#44920)

2022-02-04 17:53:58 +01:00

alerting_test.go

Chore: Remove bus (#47511) (#47677)

2022-04-13 11:51:21 +02:00

alerting.go

Chore: Remove bus from alerting rule (#47508) (#47510)

2022-04-12 14:05:00 +02:00

annotations_test.go

check that the user has RBAC permissions to save dashboard annotation (#47882) (#47920)

2022-04-20 10:49:32 +02:00

annotations.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

api.go

backport (#51964)

2022-07-08 16:28:41 +02:00

apikey.go

Access control: service account role check (#47710) (#47724)

2022-04-13 17:27:23 +01:00

app_routes.go

Instrumentation: Proxy status code correction and various improvements (#47473) (#47903)

2022-04-19 20:41:57 +02:00

basic_auth_test.go

Macaron: remove custom Request type (#37874)

2021-09-01 11:18:30 +02:00

basic_auth.go

Macaron: remove custom Request type (#37874)

2021-09-01 11:18:30 +02:00

comments.go

Comments: support live comments in dashboards and annotations (#44980)

2022-02-22 10:47:42 +03:00

common_test.go

AccessControl: Grant data source reader to all users when running oss (#49514) (#49608)

2022-05-25 14:26:25 +02:00

dashboard_permission_test.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

dashboard_permission.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

dashboard_snapshot_test.go

[v8.5.x] API: Fix snapshot responses (#53301)

2022-08-04 19:21:39 +03:00

dashboard_snapshot.go

[v8.5.x] API: Fix snapshot responses (#53301)

2022-08-04 19:21:39 +03:00

dashboard_test.go

Chore: Remove bus.Bus field (#47695) (#47704)

2022-04-13 19:11:20 +02:00

dashboard.go

Fix unmarshal of double pointer (#47586) (#47607)

2022-04-12 09:42:56 +02:00

dataproxy.go

Data Source Proxy: Migrate proxy to its own service and make more extensible (#31927)

2021-03-17 13:10:40 -04:00

datasources_test.go

V8.5.12 security patch (#486) (#55495)

2022-09-20 16:40:52 +01:00

datasources.go

V8.5.12 security patch (#486) (#55495)

2022-09-20 16:40:52 +01:00

fakes.go

Plugins: Register management endpoints only when external managed is also false (#51802) (#51816)

2022-07-07 04:58:51 -04:00

folder_permission_test.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

folder_permission.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

folder_test.go

Chore: Remove bus.Bus field (#47695) (#47704)

2022-04-13 19:11:20 +02:00

folder.go

fix argument ordering (#48124) (#48191)

2022-04-25 15:43:13 +02:00

frontend_logging_test.go

Security: Sync security changes on main (#45083)

2022-02-09 13:44:38 +01:00

frontend_logging.go

Logger migration from log15 to gokit/log (#41636)

2022-01-06 22:28:05 +08:00

frontend_metrics.go

Chore: Report frontend metrics for JS/CSS load time (#42421)

2021-12-02 09:34:39 +01:00

frontendsettings_test.go

Chore: Remove bus.Bus field (#47695) (#47704)

2022-04-13 19:11:20 +02:00

frontendsettings.go

Prometheus: Query builder UX tweaks and feedback link (#47655) (#47778)

2022-04-14 15:40:57 +02:00

grafana_com_proxy.go

Instrumentation: Proxy status code correction and various improvements (#47473) (#47903)

2022-04-19 20:41:57 +02:00

health_test.go

Chore: Remove bus from health api (#44897)

2022-02-04 14:33:35 +01:00

health.go

Chore: Remove bus from health api (#44897)

2022-02-04 14:33:35 +01:00

http_server_test.go

Plugins: Make backend plugin metrics endpoints available with optional authentication (#46467)

2022-03-29 11:18:26 +02:00

http_server.go

merged and backport to 8.5 (#50104)

2022-06-02 16:44:17 +02:00

index.go

RBAC: Fix Anonymous Editors missing dashboard controls (#52649)

2022-07-26 09:19:35 +02:00

ldap_debug_test.go

Tracing: Use common traceID context value for opentracing and opentelemetry (#46411) (#47786)

2022-04-14 18:08:51 +02:00

ldap_debug.go

Fix: Choose Lookup params per auth module (#397)

2022-07-14 15:04:41 +01:00

login_oauth_test.go

Chore: Remove bus.Bus field (#47695) (#47704)

2022-04-13 19:11:20 +02:00

login_oauth.go

Fix: Choose Lookup params per auth module (#397)

2022-07-14 15:04:41 +01:00

login_test.go

Chore: Remove bus.Dispatch from some login packages (#47248)

2022-04-04 20:36:15 +02:00

login.go

Chore: Remove bus.Dispatch from some login packages (#47248)

2022-04-04 20:36:15 +02:00

metrics_test.go

[v8.5.x] Backport 48550 to v8.5.x (#48656)

2022-05-03 20:58:02 +02:00

metrics.go

[v8.5.x] Backport 48550 to v8.5.x (#48656)

2022-05-03 20:58:02 +02:00

org_invite_test.go

backport (#51964)

2022-07-08 16:28:41 +02:00

org_invite.go

backport (#51964)

2022-07-08 16:28:41 +02:00

org_test.go

ValidatedQueries: start of validated queries API (#44731)

2022-03-07 09:33:01 -09:00

org_users_test.go

Access control: role checks before updates (#51449) (#51457)

2022-06-28 06:23:17 -04:00

org_users.go

Access control: role checks before updates (#51449) (#51457)

2022-06-28 06:23:17 -04:00

org.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

password.go

Chore: Remove bus from password (#44482)

2022-02-03 10:33:46 +01:00

playlist_play.go

Chore: Remove bus from signup and playlist api (#44485)

2022-01-27 10:33:02 +01:00

playlist.go

Chore: Remove bus from signup and playlist api (#44485)

2022-01-27 10:33:02 +01:00

plugin_dashboards_test.go

Plugins: Refactor GetPluginDashboards/LoadPluginDashboard (#46316)

2022-03-10 18:38:04 +01:00

plugin_dashboards.go

Plugins: Refactor GetPluginDashboards/LoadPluginDashboard (#46316)

2022-03-10 18:38:04 +01:00

plugin_metrics_test.go

Plugins: Make backend plugin metrics endpoints available with optional authentication (#46467)

2022-03-29 11:18:26 +02:00

plugin_metrics.go

Plugins: Make backend plugin metrics endpoints available with optional authentication (#46467)

2022-03-29 11:18:26 +02:00

plugins_test.go

Plugins: Register management endpoints only when external managed is also false (#51802) (#51816)

2022-07-07 04:58:51 -04:00

plugins.go

Plugins: Pass OAuth Token to CallResource Function (#47028)

2022-04-05 17:40:34 +02:00

preferences_test.go

Navigation: Introduce a preferences table to store Navbar preferences (#44914)

2022-03-17 12:07:20 +00:00

preferences.go

Navigation: Introduce a preferences table to store Navbar preferences (#44914)

2022-03-17 12:07:20 +00:00

quota_test.go

ValidatedQueries: start of validated queries API (#44731)

2022-03-07 09:33:01 -09:00

quota.go

Remove bus from quota, preferences, plugins, user_token (#44762)

2022-02-03 09:20:20 +01:00

render.go

Dash previews: populate crawler queue from SQL query (#44083)

2022-02-09 13:23:32 +04:00

search.go

remove bus from search service (#44825)

2022-02-03 18:46:38 +01:00

short_url_test.go

Chore: Remove bus (#47511) (#47677)

2022-04-13 11:51:21 +02:00

short_url.go

Chore: Refactor api handlers to use web.Bind (#42199)

2021-11-29 10:18:01 +01:00

signup.go

Remove bus from org invite api (#44530)

2022-01-31 17:24:52 +01:00

stars.go

Chore: Remove bus from team (#44218)

2022-01-24 11:52:35 +01:00

swagger.go

API: Extract OpenAPI specification from source code using go-swagger (#40528)

2022-02-08 13:38:43 +01:00

team_members_test.go

ValidatedQueries: start of validated queries API (#44731)

2022-03-07 09:33:01 -09:00

team_members.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

team_test.go

Access Control: Add test flag to enable access control (#46780)

2022-03-22 20:48:32 +01:00

team.go

Access control: refactor RBAC checks (#48107) (#48164)

2022-04-25 10:59:26 +02:00

user_test.go

Fix: Choose Lookup params per auth module (#397)

2022-07-14 15:04:41 +01:00

user_token_test.go

Chore: Remove bus.Bus field (#47695) (#47704)

2022-04-13 19:11:20 +02:00

user_token.go

Remove bus from quota, preferences, plugins, user_token (#44762)

2022-02-03 09:20:20 +01:00

user.go

AccessControl: Fix locked role picker in orgs/edit page (#46539)

2022-03-24 08:58:10 +01:00

utils.go

Permissions: Validate against Team/User permission role update (#29101)

2020-11-18 15:36:41 +01:00