Compare commits
No commits in common. "c8" and "c8-beta" have entirely different histories.
|
@ -1,21 +0,0 @@
|
|||
From 9c1236ba6e7d4c6506c62adeb830d9e56db7f425 Mon Sep 17 00:00:00 2001
|
||||
From: Sam Feifer <sfeifer@redhat.com>
|
||||
Date: Thu, 28 Mar 2024 13:24:35 -0400
|
||||
Subject: [PATCH] snapshot delete check org
|
||||
|
||||
|
||||
diff --git a/pkg/api/dashboard_snapshot.go b/pkg/api/dashboard_snapshot.go
|
||||
index 47ae50544a..0007e89ccb 100644
|
||||
--- a/pkg/api/dashboard_snapshot.go
|
||||
+++ b/pkg/api/dashboard_snapshot.go
|
||||
@@ -328,6 +328,10 @@ func (hs *HTTPServer) DeleteDashboardSnapshot(c *models.ReqContext) response.Res
|
||||
return response.Error(http.StatusNotFound, "Failed to get dashboard snapshot", nil)
|
||||
}
|
||||
|
||||
+ if query.Result.OrgId != c.OrgID {
|
||||
+ return response.Error(http.StatusUnauthorized, "OrgID mismatch", nil)
|
||||
+ }
|
||||
+
|
||||
if query.Result.External {
|
||||
err := deleteExternalDashboardSnapshot(query.Result.ExternalDeleteUrl)
|
||||
if err != nil {
|
|
@ -35,7 +35,7 @@ end}
|
|||
|
||||
Name: grafana
|
||||
Version: 9.2.10
|
||||
Release: 16%{?dist}
|
||||
Release: 15%{?dist}
|
||||
Summary: Metrics dashboard and graph editor
|
||||
License: AGPLv3
|
||||
URL: https://grafana.org
|
||||
|
@ -87,7 +87,6 @@ Patch8: 0008-graphite-functions-xss.patch
|
|||
Patch10: 0010-skip-tests.patch
|
||||
Patch11: 0011-remove-email-lookup.patch
|
||||
Patch12: 0012-coredump-selinux-error.patch
|
||||
Patch13: 0013-snapshot-delete-check-org.patch
|
||||
|
||||
# Patches affecting the vendor tarball
|
||||
Patch1001: 1001-vendor-patch-removed-backend-crypto.patch
|
||||
|
@ -774,7 +773,6 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
|
|||
%patch -P 10 -p1
|
||||
%patch -P 11 -p1
|
||||
%patch -P 12 -p1
|
||||
%patch -P 13 -p1
|
||||
|
||||
%patch -P 1001 -p1
|
||||
%if %{enable_fips_mode}
|
||||
|
@ -1021,11 +1019,6 @@ fi
|
|||
%{_datadir}/selinux/*/grafana.pp
|
||||
|
||||
%changelog
|
||||
* Fri Apr 5 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-16
|
||||
- Check OrdID is correct before deleting snapshot
|
||||
- fix CVE-2024-1313
|
||||
- fix CVE-2024-1394
|
||||
|
||||
* Wed Jan 31 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-15
|
||||
- Resolves RHEL-23466
|
||||
- Resolves RHEL-21027
|
||||
|
|
Loading…
Reference in New Issue