File CVE-2019-15043.patch of Package grafana

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2019-15043.patch of Package grafana (Revision a25a4f55f90b06fa7029e21aba0b45b4)

Currently displaying revision a25a4f55f90b06fa7029e21aba0b45b4 , Show latest

diff --git a/conf/defaults.ini b/conf/defaults.ini
index 2e8a990..6a5381d 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -211,6 +211,10 @@ external_enabled = true
 external_snapshot_url = https://snapshots-origin.raintank.io
 external_snapshot_name = Publish to snapshot.raintank.io
 
+# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
+# creating and deleting snapshots.
+public_mode = false
+
 # remove expired snapshot
 snapshot_remove_expired = true
 
diff --git a/conf/sample.ini b/conf/sample.ini
index 3338133..e926715 100644
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -206,6 +206,10 @@ log_queries =
 ;external_snapshot_url = https://snapshots-origin.raintank.io
 ;external_snapshot_name = Publish to snapshot.raintank.io
 
+# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
+# creating and deleting snapshots.
+;public_mode = false
+
 # remove expired snapshot
 ;snapshot_remove_expired = true
 
diff --git a/pkg/api/api.go b/pkg/api/api.go
index 9b5aae1..f747505 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -14,6 +14,7 @@ func (hs *HTTPServer) registerRoutes() {
 	reqGrafanaAdmin := middleware.ReqGrafanaAdmin
 	reqEditorRole := middleware.ReqEditorRole
 	reqOrgAdmin := middleware.ReqOrgAdmin
+	reqSnapshotPublicModeOrSignedIn := middleware.SnapshotPublicModeOrSignedIn()
 	reqCanAccessTeams := middleware.AdminOrFeatureEnabled(hs.Cfg.EditorsCanAdmin)
 	redirectFromLegacyDashboardURL := middleware.RedirectFromLegacyDashboardURL()
 	redirectFromLegacyDashboardSoloURL := middleware.RedirectFromLegacyDashboardSoloURL()
@@ -105,10 +106,10 @@ func (hs *HTTPServer) registerRoutes() {
 	r.Get("/dashboard/snapshots/", reqSignedIn, hs.Index)
 
 	// api for dashboard snapshots
-	r.Post("/api/snapshots/", bind(m.CreateDashboardSnapshotCommand{}), CreateDashboardSnapshot)
-	r.Get("/api/snapshot/shared-options/", GetSharingOptions)
+	r.Post("/api/snapshots/", reqSnapshotPublicModeOrSignedIn, bind(m.CreateDashboardSnapshotCommand{}), CreateDashboardSnapshot)
+	r.Get("/api/snapshot/shared-options/", reqSignedIn, GetSharingOptions)
 	r.Get("/api/snapshots/:key", GetDashboardSnapshot)
-	r.Get("/api/snapshots-delete/:deleteKey", Wrap(DeleteDashboardSnapshotByDeleteKey))
+	r.Get("/api/snapshots-delete/:deleteKey", reqSnapshotPublicModeOrSignedIn, Wrap(DeleteDashboardSnapshotByDeleteKey))
 	r.Delete("/api/snapshots/:key", reqEditorRole, Wrap(DeleteDashboardSnapshot))
 
 	// api renew session based on cookie
diff --git a/pkg/middleware/auth.go b/pkg/middleware/auth.go
index c00241e..f5007be 100644
--- a/pkg/middleware/auth.go
+++ b/pkg/middleware/auth.go
@@ -103,3 +103,16 @@ func AdminOrFeatureEnabled(enabled bool) macaron.Handler {
 		}
 	}
 }
+
+func SnapshotPublicModeOrSignedIn() macaron.Handler {
+	return func(c *m.ReqContext) {
+		if setting.SnapshotPublicMode {
+			return
+		}
+
+		_, err := c.Invoke(ReqSignedIn)
+		if err != nil {
+			c.JsonApiErr(500, "Failed to invoke required signed in middleware", err)
+		}
+	}
+}
diff --git a/pkg/middleware/auth_test.go b/pkg/middleware/auth_test.go
index 50d9592..6ecd884 100644
--- a/pkg/middleware/auth_test.go
+++ b/pkg/middleware/auth_test.go
@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"testing"
+	"github.com/grafana/grafana/pkg/setting"
 
 	. "github.com/smartystreets/goconvey/convey"
 )
@@ -32,4 +33,19 @@ func TestMiddlewareAuth(t *testing.T) {
 		})
 
 	})
+
+	Convey("snapshot public mode or signed in", func() {
+		middlewareScenario("Snapshot public mode disabled and unauthenticated request should return 401", func(sc *scenarioContext) {
+			sc.m.Get("/api/snapshot", SnapshotPublicModeOrSignedIn(), sc.defaultHandler)
+			sc.fakeReq("GET", "/api/snapshot").exec()
+			So(sc.resp.Code, ShouldEqual, 401)
+		})
+
+		middlewareScenario("Snapshot public mode enabled and unauthenticated request should return 200", func(sc *scenarioContext) {
+			setting.SnapshotPublicMode = true
+			sc.m.Get("/api/snapshot", SnapshotPublicModeOrSignedIn(), sc.defaultHandler)
+			sc.fakeReq("GET", "/api/snapshot").exec()
+			So(sc.resp.Code, ShouldEqual, 200)
+		})
+	})
 }
diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
index 7895461..03dc6f7 100644
--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
@@ -106,6 +106,7 @@ var (
 	ExternalSnapshotName  string
 	ExternalEnabled       bool
 	SnapShotRemoveExpired bool
+	SnapshotPublicMode    bool
 
 	// Dashboard history
 	DashboardVersionsToKeep int
@@ -718,6 +719,7 @@ func (cfg *Cfg) Load(args *CommandLineArgs) error {
 	}
 	ExternalEnabled = snapshots.Key("external_enabled").MustBool(true)
 	SnapShotRemoveExpired = snapshots.Key("snapshot_remove_expired").MustBool(true)
+	SnapshotPublicMode = snapshots.Key("public_mode").MustBool(false)
 
 	// read dashboard settings
 	dashboards := iniFile.Section("dashboards")

Places

File CVE-2019-15043.patch of Package grafana (Revision a25a4f55f90b06fa7029e21aba0b45b4)

Places