Sqlstore: guard against getting a dashboard without specifying identi… (#22246)

* Sqlstore: guard against getting a dashboard without specifying identifier

* Sqlstore: linting

pkg/models/dashboards.go

@@ -32,6 +32,7 @@ var (
 	ErrDashboardUidToLong                        = errors.New("uid to long. max 40 characters")
 	ErrDashboardUidToLong                        = errors.New("uid to long. max 40 characters")
 	ErrDashboardCannotSaveProvisionedDashboard   = errors.New("Cannot save provisioned dashboard")
 	ErrDashboardCannotSaveProvisionedDashboard   = errors.New("Cannot save provisioned dashboard")
 	ErrDashboardCannotDeleteProvisionedDashboard = errors.New("provisioned dashboard cannot be deleted")
 	ErrDashboardCannotDeleteProvisionedDashboard = errors.New("provisioned dashboard cannot be deleted")
+	ErrDashboardIdentifierNotSet                 = errors.New("Unique identfier needed to be able to get a dashboard")
 	RootFolderName                               = "General"
 	RootFolderName                               = "General"
 )
 )
 
 

pkg/services/sqlstore/dashboard.go

@@ -169,6 +169,10 @@ func generateNewDashboardUid(sess *DBSession, orgId int64) (string, error) {
 }
 }
 
 
 func GetDashboard(query *models.GetDashboardQuery) error {
 func GetDashboard(query *models.GetDashboardQuery) error {
+	if query.Id == 0 && len(query.Slug) == 0 && len(query.Uid) == 0 {
+		return models.ErrDashboardIdentifierNotSet
+	}
+
 	dashboard := models.Dashboard{Slug: query.Slug, OrgId: query.OrgId, Id: query.Id, Uid: query.Uid}
 	dashboard := models.Dashboard{Slug: query.Slug, OrgId: query.OrgId, Id: query.Id, Uid: query.Uid}
 	has, err := x.Get(&dashboard)
 	has, err := x.Get(&dashboard)
 
 

pkg/services/sqlstore/dashboard_test.go

@@ -88,6 +88,15 @@ func TestDashboardDataAccess(t *testing.T) {
 				So(query.Result.IsFolder, ShouldBeFalse)
 				So(query.Result.IsFolder, ShouldBeFalse)
 			})
 			})
 
 
+			Convey("Shouldn't be able to get a dashboard with just an OrgID", func() {
+				query := m.GetDashboardQuery{
+					OrgId: 1,
+				}
+
+				err := GetDashboard(&query)
+				So(err, ShouldEqual, m.ErrDashboardIdentifierNotSet)
+			})
+
 			Convey("Should be able to delete dashboard", func() {
 			Convey("Should be able to delete dashboard", func() {
 				dash := insertTestDashboard("delete me", 1, 0, false, "delete this")
 				dash := insertTestDashboard("delete me", 1, 0, false, "delete this")