graphite-project/graphite-web — pull request #143 by captsens (2013-01-27 06:22:11+00:00)
Title: Add ability to require logged-in user in dashboard to save or delete

Hi

We're soon to put graphite into production at TNS, and we'd like a little more security on the dashboard than currently exists - hence this pull request.

This patch adds a minimal security model to the dashboard. The server can be configured to require dashboard users to be logged in before they're allowed to save or delete dashboards. Assuming this meets with your approval, I'm planning future work to add the concept of ownership and access rights to dashboards.

The main functionality in this patch is:

* Setting to enable these restrictions (False by default)
* Allow the user to login and logout from the Dashboard menu - uses AJAX rather than redirect
* Disable the Save and Save As menu items if these should prohibited, plus prevent these actions in the server
* Likewise for the Delete button in the Finder.

I'm hoping that this will be a reasonable first step on a security model for the dashboard, but I'm happy to make appropriate changes so that it's more generally useful.

Cheers ................................... John Dickson