From 4cd1a113ef79b1dcb28d3f368773d8bd6014f9d4 Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Fri, 13 May 2022 15:07:08 +0300 Subject: [PATCH] Access control: Fix listing data sources for org admins (#48961) * Access control: Fix listing data sources for org admins * Access control: always list non-core plugins for org admins --- pkg/api/plugins.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/api/plugins.go b/pkg/api/plugins.go index 466093c8ac1..b3e973c628d 100644 --- a/pkg/api/plugins.go +++ b/pkg/api/plugins.go @@ -38,7 +38,7 @@ func (hs *HTTPServer) GetPluginList(c *models.ReqContext) response.Response { // When using access control anyone that can create a data source should be able to list all data sources installed // Fallback to only letting admins list non-core plugins hasAccess := accesscontrol.HasAccess(hs.AccessControl, c) - if !hasAccess(accesscontrol.ReqOrgAdmin, accesscontrol.EvalPermission(datasources.ActionCreate)) || c.HasRole(models.ROLE_ADMIN) { + if !hasAccess(accesscontrol.ReqOrgAdmin, accesscontrol.EvalPermission(datasources.ActionCreate)) && !c.HasRole(models.ROLE_ADMIN) { coreFilter = "1" }