opensource/grafana
1
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-08-03 06:22:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

RBAC: Fix access checks for interactions with RBAC roles in hosted Grafana (#85485)

Browse Source 
* don't check global permissions for cloud instances

* linting
This commit is contained in:
Ieva
2024-04-03 11:44:16 +01:00
committed by GitHub
parent eb3d088645
commit beb15d938b
1 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
pkg/services/accesscontrol/middleware.go
View File

@ -338,18 +338,23 @@ func UseOrgFromRequestData(c *contextmodel.ReqContext) (int64, error) {
}
// UseGlobalOrgFromRequestData returns global org if `global` flag is set or the org where user is logged in.
func UseGlobalOrgFromRequestData(c *contextmodel.ReqContext) (int64, error) {
query, err := getOrgQueryFromRequest(c)
if err != nil {
// Special case of macaron handling invalid params
return NoOrgID, org.ErrOrgNotFound.Errorf("failed to get organization from context: %w", err)
}
// If RBACSingleOrganization is set, the org where user is logged in is returned - this is intended only for cloud workflows, where instances are limited to a single organization.
func UseGlobalOrgFromRequestData(cfg *setting.Cfg) func(*contextmodel.ReqContext) (int64, error) {
return func(c *contextmodel.ReqContext) (int64, error) {
query, err := getOrgQueryFromRequest(c)
if err != nil {
// Special case of macaron handling invalid params
return NoOrgID, org.ErrOrgNotFound.Errorf("failed to get organization from context: %w", err)
}
if query.Global {
return GlobalOrgID, nil
}
// We only check permissions in the global organization if we are not running a SingleOrganization setup
// That allows Organization Admins to modify global roles and make global assignments.
if query.Global && !cfg.RBACSingleOrganization {
return GlobalOrgID, nil
}
return c.SignedInUser.GetOrgID(), nil
return c.SignedInUser.GetOrgID(), nil
}
}
// UseGlobalOrgFromRequestParams returns global org if `global` flag is set or the org where user is logged in.