IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Plugins Catalog: Only allow admins to access plugins catalog (#57101)

Browse Source 
* feat(plugins-catalog): only allow admins to access plugins catalog routes

* add backend check

* fix(plugins-catalog): update route role access to include server admins

Co-authored-by: Will Browne <will.browne@grafana.com>
This commit is contained in:
Jack Westbrook 2022-11-30 09:41:28 +01:00 committed by GitHub
parent c72322874d
commit 207b2993b2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/api/api.go
View File

@ -117,10 +117,10 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/live/pipeline", reqGrafanaAdmin, hs.Index) r.Get("/live/pipeline", reqGrafanaAdmin, hs.Index)
r.Get("/live/cloud", reqGrafanaAdmin, hs.Index) r.Get("/live/cloud", reqGrafanaAdmin, hs.Index)
r.Get("/plugins", reqSignedIn, hs.Index) r.Get("/plugins", middleware.CanAdminPlugins(hs.Cfg), hs.Index)
r.Get("/plugins/:id/", reqSignedIn, hs.Index) r.Get("/plugins/:id/", middleware.CanAdminPlugins(hs.Cfg), hs.Index)
r.Get("/plugins/:id/edit", reqSignedIn, hs.Index) // deprecated r.Get("/plugins/:id/edit", middleware.CanAdminPlugins(hs.Cfg), hs.Index) // deprecated
r.Get("/plugins/:id/page/:page", reqSignedIn, hs.Index) r.Get("/plugins/:id/page/:page", middleware.CanAdminPlugins(hs.Cfg), hs.Index)
// App Root Page // App Root Page
appPluginIDScope := plugins.ScopeProvider.GetResourceScope(ac.Parameter(":id")) appPluginIDScope := plugins.ScopeProvider.GetResourceScope(ac.Parameter(":id"))
r.Get("/a/:id/*", authorize(reqSignedIn, ac.EvalPermission(plugins.ActionAppAccess, appPluginIDScope)), hs.Index) r.Get("/a/:id/*", authorize(reqSignedIn, ac.EvalPermission(plugins.ActionAppAccess, appPluginIDScope)), hs.Index)

10
pkg/middleware/auth.go
View File

@ -10,6 +10,7 @@ import (
"github.com/grafana/grafana/pkg/infra/db" "github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/middleware/cookies" "github.com/grafana/grafana/pkg/middleware/cookies"
"github.com/grafana/grafana/pkg/models" "github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/plugins"
"github.com/grafana/grafana/pkg/services/auth" "github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/dashboards" "github.com/grafana/grafana/pkg/services/dashboards"
"github.com/grafana/grafana/pkg/services/org" "github.com/grafana/grafana/pkg/services/org"
@ -86,6 +87,15 @@ func EnsureEditorOrViewerCanEdit(c *models.ReqContext) {
} }
} }
func CanAdminPlugins(cfg *setting.Cfg) func(c *models.ReqContext) {
return func(c *models.ReqContext) {
if !plugins.ReqCanAdminPlugins(cfg)(c) {
accessForbidden(c)
return
}
}
}
func RoleAuth(roles ...org.RoleType) web.Handler { func RoleAuth(roles ...org.RoleType) web.Handler {
return func(c *models.ReqContext) { return func(c *models.ReqContext) {
ok := false ok := false

3
public/app/features/plugins/admin/routes.tsx
View File

@ -10,18 +10,21 @@ const DEFAULT_ROUTES = [
{ {
path: '/plugins', path: '/plugins',
navId: 'plugins', navId: 'plugins',
roles: () => ['Admin', 'ServerAdmin'],
routeName: PluginAdminRoutes.Home, routeName: PluginAdminRoutes.Home,
component: SafeDynamicImport(() => import(/* webpackChunkName: "PluginListPage" */ './pages/Browse')), component: SafeDynamicImport(() => import(/* webpackChunkName: "PluginListPage" */ './pages/Browse')),
}, },
{ {
path: '/plugins/browse', path: '/plugins/browse',
navId: 'plugins', navId: 'plugins',
roles: () => ['Admin', 'ServerAdmin'],
routeName: PluginAdminRoutes.Browse, routeName: PluginAdminRoutes.Browse,
component: SafeDynamicImport(() => import(/* webpackChunkName: "PluginListPage" */ './pages/Browse')), component: SafeDynamicImport(() => import(/* webpackChunkName: "PluginListPage" */ './pages/Browse')),
}, },
{ {
path: '/plugins/:pluginId/', path: '/plugins/:pluginId/',
navId: 'plugins', navId: 'plugins',
roles: () => ['Admin', 'ServerAdmin'],
routeName: PluginAdminRoutes.Details, routeName: PluginAdminRoutes.Details,
component: SafeDynamicImport(() => import(/* webpackChunkName: "PluginPage" */ './pages/PluginDetails')), component: SafeDynamicImport(() => import(/* webpackChunkName: "PluginPage" */ './pages/PluginDetails')),
}, },