IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2024-12-30 10:47:30 -06:00
Code Issues Packages Projects Releases Wiki Activity

Permissions: Fix team and role permissions on folders/dashboards not displayed for non Grafana Admin users (#31132)

Browse Source 
* Cfg: fix hidden users initialization

* add tests

* do not call isHiddenUser function for non-user permission

* do not call isHiddenUser function for non-user permission
This commit is contained in:
Agnès Toulet 2021-02-12 16:08:18 +01:00 committed by GitHub
parent 92ae019f8e
commit 7f1f559929
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 92 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/api/dashboard_permission.go
View File

@ -32,7 +32,7 @@ func (hs *HTTPServer) GetDashboardPermissionList(c *models.ReqContext) response.
filteredAcls := make([]*models.DashboardAclInfoDTO, 0, len(acl))
for _, perm := range acl {
if dtos.IsHiddenUser(perm.UserLogin, c.SignedInUser, hs.Cfg) {
if perm.UserId > 0 && dtos.IsHiddenUser(perm.UserLogin, c.SignedInUser, hs.Cfg) {
continue
}

2
pkg/api/dtos/models.go
View File

@ -77,7 +77,7 @@ func GetGravatarUrlWithDefault(text string, defaultText string) string {
}
func IsHiddenUser(userLogin string, signedInUser *models.SignedInUser, cfg *setting.Cfg) bool {
if signedInUser.IsGrafanaAdmin || userLogin == signedInUser.Login {
if userLogin == "" || signedInUser.IsGrafanaAdmin || userLogin == signedInUser.Login {
return false
}

86
pkg/api/dtos/models_test.go Normal file
View File

@ -0,0 +1,86 @@
package dtos
import (
"testing"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
"gotest.tools/assert"
)
func TestIsHiddenUser(t *testing.T) {
emptyHiddenUsers := map[string]struct{}{}
hiddenUser := map[string]struct{}{
"user": {},
}
testcases := []struct {
desc string
userLogin string
signedInUser *models.SignedInUser
hiddenUsers map[string]struct{}
expected bool
}{
{
desc: "non-server admin user should see non-hidden user",
userLogin: "user",
signedInUser: &models.SignedInUser{
IsGrafanaAdmin: false,
Login: "admin",
},
hiddenUsers: emptyHiddenUsers,
expected: false,
},
{
desc: "non-server admin user should not see hidden user",
userLogin: "user",
signedInUser: &models.SignedInUser{
IsGrafanaAdmin: false,
Login: "admin",
},
hiddenUsers: hiddenUser,
expected: true,
},
{
desc: "non-server admin user should see himself, even if he's hidden",
userLogin: "admin",
signedInUser: &models.SignedInUser{
IsGrafanaAdmin: false,
Login: "admin",
},
hiddenUsers: map[string]struct{}{
"admin": {},
},
expected: false,
},
{
desc: "server admin user should see hidden user",
userLogin: "user",
signedInUser: &models.SignedInUser{
IsGrafanaAdmin: true,
Login: "admin",
},
hiddenUsers: hiddenUser,
expected: false,
},
{
desc: "server admin user should see non-hidden user",
userLogin: "user",
signedInUser: &models.SignedInUser{
IsGrafanaAdmin: true,
Login: "admin",
},
hiddenUsers: emptyHiddenUsers,
expected: false,
},
}
for _, c := range testcases {
t.Run(c.desc, func(t *testing.T) {
isHidden := IsHiddenUser(c.userLogin, c.signedInUser, &setting.Cfg{
HiddenUsers: c.hiddenUsers,
})
assert.Equal(t, c.expected, isHidden)
})
}
}

2
pkg/api/folder_permission.go
View File

@ -34,7 +34,7 @@ func (hs *HTTPServer) GetFolderPermissionList(c *models.ReqContext) response.Res
filteredAcls := make([]*models.DashboardAclInfoDTO, 0, len(acl))
for _, perm := range acl {
if dtos.IsHiddenUser(perm.UserLogin, c.SignedInUser, hs.Cfg) {
if perm.UserId > 0 && dtos.IsHiddenUser(perm.UserLogin, c.SignedInUser, hs.Cfg) {
continue
}

4
pkg/setting/setting.go
View File

@ -1196,7 +1196,9 @@ func readUserSettings(iniFile *ini.File, cfg *Cfg) error {
hiddenUsers := users.Key("hidden_users").MustString("")
for _, user := range strings.Split(hiddenUsers, ",") {
user = strings.TrimSpace(user)
cfg.HiddenUsers[user] = struct{}{}
if user != "" {
cfg.HiddenUsers[user] = struct{}{}
}
}
return nil