grafana

Commit Graph

Author	SHA1	Message	Date
Ezequiel Victorero	dfab100dc7	Chore: sanitize values before being logged from request headers (#49245 ) * Chore: sanitize values being logged directly from request headers	3 years ago
sh0rez	3d5d8c785b	pkg/web: restrict handler types (#48495 ) Makes `pkg/web` only accept handles from the following set: ```go handlerStd = func(http.ResponseWriter, http.Request) handlerStdCtx = func(http.ResponseWriter, http.Request, web.Context) handlerStdReqCtx = func(http.ResponseWriter, http.Request, models.ReqContext) handlerReqCtx = func(models.ReqContext) handlerReqCtxRes = func(models.ReqContext) Response handlerCtx = func(web.Context) ``` This is a first step to reducing above set to only `http.Handler`. --- Due to a cyclic import situation between `pkg/models` and `pkg/web`, parts of this PR were put into `pkg/api/response`, even though they definitely do not belong there. This however is _temporary_ until we untangle `models.ReqContext`.	3 years ago
ying-jeanne	0bf889e058	Fix unmaarshal of double pointer (#47586 ) * Fix unmaarshal of double pointer * update sdk version	3 years ago
Marcus Efraimsson	6c7d326499	Plugins: Refactor GetPluginDashboards/LoadPluginDashboard (#46316 ) Refactors GetPluginDashboards/LoadPluginDashboard by moving database interaction from plugin management to the plugindashboards service. Fixes #44553 Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Dimitris Sotirakis	605d056136	Security: Sync security changes on main (#45083 ) * * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search * Teams: Ensure that users searching for teams are only able see teams they have access to * Teams: Require teamGuardian admin privileges to list team members * Teams: Prevent org viewers from administering teams * Teams: Add org_id condition to team count query * Teams: clarify permission requirements in teams api docs * Teams: expand scenarios for team search tests * Teams: mock teamGuardian in tests Co-authored-by: Dan Cech <dcech@grafana.com> * remove duplicate WHERE statement * Fix for CVE-2022-21702 (cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e) * Lint and test fixes (cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981) * check content type properly (cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98) * basic csrf origin check (cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1) * compare origin to host (cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42) * simplify url parsing (cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d) * check csrf for GET requests, only compare origin (cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709) * parse content type properly (cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0) * mentioned get in the comment (cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345) * add content-type: application/json to test HTTP requests * fix pluginproxy test * Fix linter when comparing errors Co-authored-by: Kevin Minehart <kmineh0151@gmail.com> Co-authored-by: Dan Cech <dcech@grafana.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com>	3 years ago
sam boyer	6a2255abe7	pkg/web: X-Forwarded-For multi-IP handling (#45098 ) It is conventionally common for the X-Forwarded-For header to contain a comma-separated list of IP addresses, with each intermediate proxy adding an additional item as a request passes through it. This change makes the web framework handle this case appropriately, always selecting the first item in the list.	3 years ago
Marcus Efraimsson	94edd7a762	Plugins: Refactor plugin dashboards (#44315 ) Moves/refactor Grafana specific functionality related to plugin dashboards out to specific services for importing dashboards and keep app plugin dashboards up-to-date. Fixes #44257	3 years ago
Igor Suleymanov	fdeaf7a5c4	Add nil checks to HTTP request validation dispatch (#44371 ) Signed-off-by: Igor Suleymanov <igor.suleymanov@grafana.com>	3 years ago
ying-jeanne	7422789ec7	Remove Macaron ParamsInt64 function from code base (#43810 ) * draft commit * change all calls * Compilation errors	3 years ago
Serge Zaitsev	f5802878f1	Chore: Move remaining web framework code to pkg/web, remove macaron binding module (#43018 ) * remove macaron binding dependency * completely purge macaron binding * move everything to pkg/web * remove non-go files from pkg/web * clean up leftovers of macaron imports * make linter happy	3 years ago
Serge Zaitsev	57fcfd578d	Chore: replace macaron with web package (#40136 ) * replace macaron with web package * add web.go	4 years ago

11 Commits (521b0202e2cb6a04a2de3ca85389b34b5e7ab6d3)