Merge remote-tracking branch 'grafana/master'

* grafana/master:
  added rule prefer const to tslint (grafana#13071)
  dep ensure (grafana#13074)
  changed var to const 2 (grafana#13068)
  changed var to const (grafana#13061)
  update latest.json to latest stable version
  docs: corrected docs description for setting
  changelog: add notes about 4.6.4 and 5.2.3 releases

Author: ryantxu

CHANGELOG.md

@@ -73,6 +73,12 @@ These are new features that's still being worked on and are in an experimental p
 
 * **Frontend**: Convert all Frontend Karma tests to Jest tests [#12224](https://github.com/grafana/grafana/issues/12224)
 
+# 5.2.3 (2018-08-29)
+
+### Important fix for LDAP & OAuth login vulnerability
+
+See [security announcement](https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050) for details.
+
 # 5.2.2 (2018-07-25)
 
 ### Minor
@@ -441,6 +447,12 @@ The following properties have been deprecated and will be removed in a future re
   - `uri` property in `GET /api/search` -> Use new `url` or `uid` property instead
   - `meta.slug` property in `GET /api/dashboards/uid/:uid` and `GET /api/dashboards/db/:slug` -> Use new `meta.url` or `dashboard.uid` property instead
 
+# 4.6.4 (2018-08-29)
+
+### Important fix for LDAP & OAuth login vulnerability
+
+See [security announcement](https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050) for details.
+
 # 4.6.3 (2017-12-14)
 
 ## Fixes

Gopkg.lock

@@ -266,7 +266,8 @@ The number of days the keep me logged in / remember me cookie lasts.
 
 ### secret_key
 
-Used for signing keep me logged in / remember me cookies.
+Used for signing some datasource settings like secrets and passwords. Cannot be changed without requiring an update
+to datasource settings to re-encode them.
 
 ### disable_gravatar
 

docs/sources/installation/configuration.md

@@ -1,4 +1,4 @@
 {
-  "stable": "5.2.0",
-  "testing": "5.2.0"
+  "stable": "5.2.3",
+  "testing": "5.2.3"
 }

latest.json

@@ -1,4 +1,4 @@
 import { Emitter } from './utils/emitter';
 
-var appEvents = new Emitter();
+const appEvents = new Emitter();
 export default appEvents;

public/app/core/app_events.ts

@@ -99,9 +99,9 @@ function link(scope, elem, attrs) {
   if (scope.codeEditorFocus) {
     setTimeout(function() {
       textarea.focus();
-      var domEl = textarea[0];
+      const domEl = textarea[0];
       if (domEl.setSelectionRange) {
-        var pos = textarea.val().length * 2;
+        const pos = textarea.val().length * 2;
         domEl.setSelectionRange(pos, pos);
       }
     }, 100);

public/app/core/components/code_editor/code_editor.ts

@@ -1,6 +1,6 @@
 import coreModule from 'app/core/core_module';
 
-var template = `
+const template = `
 <select class="gf-form-input" ng-model="ctrl.model" ng-options="f.value as f.text for f in ctrl.options"></select>
 `;
 

public/app/core/components/dashboard_selector.ts

@@ -49,7 +49,7 @@ export class GrafanaCtrl {
     };
 
     $rootScope.onAppEvent = function(name, callback, localScope) {
-      var unbind = $rootScope.$on(name, callback);
+      const unbind = $rootScope.$on(name, callback);
       var callerScope = this;
       if (callerScope.$id === 1 && !localScope) {
         console.log('warning rootScope onAppEvent called without localscope');
@@ -76,7 +76,7 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop
     controller: GrafanaCtrl,
     link: (scope, elem) => {
       var sidemenuOpen;
-      var body = $('body');
+      const body = $('body');
 
       // see https://github.com/zenorocha/clipboard.js/issues/155
       $.fn.modal.Constructor.prototype.enforceFocus = function() {};
@@ -153,7 +153,7 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop
       // handle in active view state class
       var lastActivity = new Date().getTime();
       var activeUser = true;
-      var inActiveTimeLimit = 60 * 1000;
+      const inActiveTimeLimit = 60 * 1000;
       var sidemenuHidden = false;
 
       function checkForInActiveUser() {
@@ -215,16 +215,16 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop
 
       // handle document clicks that should hide things
       body.click(function(evt) {
-        var target = $(evt.target);
+        const target = $(evt.target);
         if (target.parents().length === 0) {
           return;
         }
 
         // for stuff that animates, slides out etc, clicking it needs to
         // hide it right away
-        var clickAutoHide = target.closest('[data-click-hide]');
+        const clickAutoHide = target.closest('[data-click-hide]');
         if (clickAutoHide.length) {
-          var clickAutoHideParent = clickAutoHide.parent();
+          const clickAutoHideParent = clickAutoHide.parent();
           clickAutoHide.detach();
           setTimeout(function() {
             clickAutoHideParent.append(clickAutoHide);
@@ -245,7 +245,7 @@ export function grafanaAppDirective(playlistSrv, contextSrv, $timeout, $rootScop
         }
 
         // hide popovers
-        var popover = elem.find('.popover');
+        const popover = elem.find('.popover');
         if (popover.length > 0 && target.parents('.graph-legend').length === 0) {
           popover.hide();
         }

public/app/core/components/grafana_app.ts

@@ -12,7 +12,7 @@ function escapeString(str: string): string {
  * Determines if a value is an object
 */
 export function isObject(value: any): boolean {
-  var type = typeof value;
+  const type = typeof value;
   return !!value && type === 'object';
 }
 
@@ -55,7 +55,7 @@ export function getType(object: Object): string {
  * Generates inline preview for a JavaScript object based on a value
 */
 export function getValuePreview(object: Object, value: string): string {
-  var type = getType(object);
+  const type = getType(object);
 
   if (type === 'null' || type === 'undefined') {
     return type;

public/app/core/components/json_explorer/helpers.ts

@@ -279,7 +279,7 @@ export class JsonExplorer {
       const objectWrapperSpan = createElement('span');
 
       // get constructor name and append it to wrapper span
-      var constructorName = createElement('span', 'constructor-name', this.constructorName);
+      const constructorName = createElement('span', 'constructor-name', this.constructorName);
       objectWrapperSpan.appendChild(constructorName);
 
       // if it's an array append the array specific elements like brackets and length