Blame SOURCES/011-CVE-2021-39226.patch

702879
diff --git a/pkg/api/dashboard_snapshot.go b/pkg/api/dashboard_snapshot.go
4bd38e
index 4f7a4b8d09..b500639d15 100644
702879
--- a/pkg/api/dashboard_snapshot.go
702879
+++ b/pkg/api/dashboard_snapshot.go
4bd38e
@@ -144,6 +144,9 @@ func CreateDashboardSnapshot(c *models.ReqContext, cmd models.CreateDashboardSna
702879
 // GET /api/snapshots/:key
4bd38e
 func GetDashboardSnapshot(c *models.ReqContext) response.Response {
702879
 	key := c.Params(":key")
702879
+	if len(key) == 0 {
4bd38e
+		return response.Error(404, "Snapshot not found", nil)
702879
+	}
702879
 	query := &models.GetDashboardSnapshotQuery{Key: key}
702879
 
702879
 	err := bus.Dispatch(query)
4bd38e
@@ -210,6 +213,9 @@ func deleteExternalDashboardSnapshot(externalUrl string) error {
702879
 // GET /api/snapshots-delete/:deleteKey
4bd38e
 func DeleteDashboardSnapshotByDeleteKey(c *models.ReqContext) response.Response {
702879
 	key := c.Params(":deleteKey")
702879
+	if len(key) == 0 {
4bd38e
+		return response.Error(404, "Snapshot not found", nil)
702879
+	}
702879
 
702879
 	query := &models.GetDashboardSnapshotQuery{DeleteKey: key}
702879
 
4bd38e
@@ -240,6 +246,9 @@ func DeleteDashboardSnapshotByDeleteKey(c *models.ReqContext) response.Response
702879
 // DELETE /api/snapshots/:key
4bd38e
 func DeleteDashboardSnapshot(c *models.ReqContext) response.Response {
702879
 	key := c.Params(":key")
702879
+	if len(key) == 0 {
4bd38e
+		return response.Error(404, "Snapshot not found", nil)
702879
+	}
702879
 
702879
 	query := &models.GetDashboardSnapshotQuery{Key: key}
702879
 
702879
diff --git a/vendor/gopkg.in/macaron.v1/router.go b/vendor/gopkg.in/macaron.v1/router.go
702879
index df593d669a..46cb0c160f 100644
702879
--- a/vendor/gopkg.in/macaron.v1/router.go
702879
+++ b/vendor/gopkg.in/macaron.v1/router.go
702879
@@ -289,10 +289,12 @@ func (r *Router) SetHandlerWrapper(f func(Handler) Handler) {
702879
 func (r *Router) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
702879
 	if t, ok := r.routers[req.Method]; ok {
702879
 		// Fast match for static routes
702879
-		leaf := r.getLeaf(req.Method, req.URL.Path)
702879
-		if leaf != nil {
702879
-			leaf.handle(rw, req, nil)
702879
-			return
702879
+		if !strings.ContainsAny(req.URL.Path, ":*") {
702879
+			leaf := r.getLeaf(req.Method, req.URL.Path)
702879
+			if leaf != nil {
702879
+				leaf.handle(rw, req, nil)
702879
+				return
702879
+			}
702879
 		}
702879
 
702879
 		h, p, ok := t.Match(req.URL.EscapedPath())