Ieva c048378ad5 V9.1.3.1 security patch (#492) ...

* apply security fix for admin only folder migration (#482)

* Data source: prevent from using auth proxy header as custom data source header (#474)

* applying changes from 446/fix-user-escalation-through-auth-proxy

* linting

* only validate custom headers if auth proxy is enabled

* import ordering

* add links to CVE

* clean up

* remove typo

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
(cherry picked from commit 0100a6aa9645313b25a79a17d947cbf936cc4e76)

2022-09-20 11:41:29 +02:00

..

accesscontrol

[v9.1.x] RBAC: Fix resolver issue on wildcard resulting in wrong status code (#54692)

2022-09-06 09:08:49 +02:00

alerting

Renderer: Add sanitize API (#50936)

2022-07-07 15:32:18 +04:00

annotations

Chore: Add dashboard UID as query parameter of Get annotation endpoint (#52764)

2022-07-26 21:52:34 -04:00

auth

Sync: Move ActiveTokenCount to a new service (#52991)

2022-07-29 16:30:46 +02:00

cleanup

backend/dashboardsnapshot service: move models (#50898)

2022-06-17 09:09:01 -04:00

comments

backend/services: Move GetDashboard from sqlstore to dashboard service (#48971)

2022-05-17 14:52:22 -04:00

contexthandler

Auth: Implement Token URL JWT Auth (#52662)

2022-07-27 16:10:47 +02:00

correlations

Correlations: Use correct fallback handlers (#54511) (#54569)

2022-09-01 15:08:10 +02:00

dashboardimport

Chore: Move swagger definitions to the handlers (#52643)

2022-07-27 09:54:37 -04:00

dashboards

RBAC: Fix dashboard filter in SQLBuilder (#53379) (#53506)

2022-08-10 11:58:12 +02:00

dashboardsnapshots

API: Fix snapshot responses (#52998) (#53244)

2022-08-04 12:12:34 +03:00

dashboardversion

chore/backend: move dashboard errors to dashboard service (#51593)

2022-06-30 09:31:54 -04:00

datasourceproxy

backend/datasources: move datasources models into the datasources service package (#51267)

2022-06-27 12:23:15 -04:00

datasources

V9.1.3.1 security patch (#492)

2022-09-20 11:41:29 +02:00

encryption

Encryption: Add support for decrypting ciphertexts with algorithm metadata (#49312)

2022-05-20 17:11:51 +02:00

export

Previews: datasource permissions (#52747)

2022-07-28 16:40:26 +04:00

featuremgmt

Prometheus: Promote Azure auth flag to configuration (#53447) (#53598)

2022-08-11 10:30:40 -04:00

guardian

Search: Move entity events to transaction (#52394)

2022-08-01 18:56:36 +03:00

hooks

Migrate to Wire for dependency injection (#32289)

2021-08-25 15:11:22 +02:00

kmsproviders

Encryption: Refactor secrets.Service initialization (#51091)

2022-07-07 09:48:25 +02:00

ldap

LDAP: Improve errors and documentation (#52111)

2022-07-12 11:11:09 -04:00

libraryelements

LibraryElements: Fix inability to delete library panels under MySQL (#54600) (#54711)

2022-09-05 10:29:56 -04:00

librarypanels

Search: Move entity events to transaction (#52394)

2022-08-01 18:56:36 +03:00

licensing

RBAC: Make RBAC action names more consistent (#49730)

2022-06-02 13:14:48 +01:00

live

sync routing tree with latest changes in Gin (#51541)

2022-06-29 19:05:57 +03:00

login

[v9.1.x] fix: min metric to hourly metric (#55244)

2022-09-15 16:21:59 +02:00

multildap

Split Create User (#50502)

2022-06-28 14:32:25 +02:00

ngalert

Alerting: Fix send resolved notifications (#54793) (#55256)

2022-09-15 19:55:01 +01:00

notifications

Alerting: Fix Teams notifier not failing on 200 response with error (#52254)

2022-07-14 13:15:18 -04:00

oauthtoken

Chore: Move user errors to user service (#52460)

2022-07-20 14:50:06 +02:00

org

Chore: Split delete user method (#52216)

2022-07-19 16:01:05 +02:00

playlist

Chore: Introduce playlist service (#52252)

2022-07-18 05:26:35 -04:00

plugindashboards

Chore: Make test tracer noop and return no errors (#50797)

2022-06-15 12:40:41 +02:00

pluginsettings

Plugins: Add plugin settings DTO (#46283)

2022-03-18 20:49:13 +01:00

preference

Add delete user from other services/stores (#51912)

2022-07-15 18:06:44 +02:00

provisioning

Provisioning Contact points: Support disableResolveMessage via YAML too (#54122) (#55254)

2022-09-15 16:53:00 -05:00

publicdashboards

fix audit log prefix for public dashboards (#53070)

2022-08-01 14:46:48 -08:00

query

Plugins: Remove various custom headers logic (#54146) (#54284)

2022-08-29 10:21:34 +02:00

queryhistory

Chore: Move swagger definitions to the handlers (#52643)

2022-07-27 09:54:37 -04:00

quota

Sync: Move ActiveTokenCount to a new service (#52991)

2022-07-29 16:30:46 +02:00

rendering

Rendering: Add support for renderer token (#54425) (#54431)

2022-08-30 11:32:29 +01:00

screenshot

Alerting: Better metrics and renamed BrowserScreenshotService (#51564)

2022-06-30 17:47:23 +01:00

search

Search (SQL): support dashboardUID query parameter (#50121)

2022-06-02 12:56:01 -07:00

searchusers

Chore: Move swagger definitions to the handlers (#52643)

2022-07-27 09:54:37 -04:00

searchV2

Search: Add substring matcher (#54895)

2022-09-09 14:20:20 +02:00

secrets

Chaging log level when secret is not found (#53007)

2022-08-01 09:25:24 -03:00

serviceaccounts

Chore: Move swagger definitions to the handlers (#52643)

2022-07-27 09:54:37 -04:00

shorturls

ShortURL: Use new Error type (#50859)

2022-06-15 15:11:36 +02:00

sqlstore

V9.1.3.1 security patch (#492)

2022-09-20 11:41:29 +02:00

star

Add delete user from other services/stores (#51912)

2022-07-15 18:06:44 +02:00

store

Storage: move file quota check to service (#53058)

2022-08-01 22:53:44 +04:00

teamguardian

Chore: Split delete user method (#52216)

2022-07-19 16:01:05 +02:00

thumbs

Previews: return an empty array, rather than a null, if a dashboard has no datasources (#52961)

2022-07-28 22:49:06 +04:00

updatechecker

Logging: Unify logging fakes (#48822)

2022-05-06 17:44:22 +02:00

user

Chore: Move user errors to user service (#52460)

2022-07-20 14:50:06 +02:00

userauth

Chore: Split delete user method (#52216)

2022-07-19 16:01:05 +02:00

validations

Migrate to Wire for dependency injection (#32289)

2021-08-25 15:11:22 +02:00