Fix to check white list when the frontend tries to connect DB

pkg/api/dataproxy.go

@@ -91,21 +91,24 @@ func ProxyDataSourceRequest(c *middleware.Context) {
 		return
 	}
 
-	targetUrl, _ := url.Parse(ds.Url)
-	if len(setting.DataProxyWhiteList) > 0 {
-		if _, exists := setting.DataProxyWhiteList[targetUrl.Host]; !exists {
-			c.JsonApiErr(403, "Data proxy hostname and ip are not included in whitelist", nil)
+	switch ds.Type {
+	case m.DS_CLOUDWATCH:
+		cloudwatch.HandleRequest(c, ds)
+
+	case m.DS_SQLDB:
+		host, _ := ds.JsonData.Get("host").String()
+		if !checkWhiteList(c, host) {
 			return
 		}
-	}
 
-	if ds.Type == m.DS_CLOUDWATCH {
-		cloudwatch.HandleRequest(c, ds)
-
-	} else if ds.Type == m.DS_SQLDB {
 		sqldb.HandleRequest(c, ds)
 
-	} else {
+	default:
+		targetUrl, _ := url.Parse(ds.Url)
+		if !checkWhiteList(c, targetUrl.Host) {
+			return
+		}
+
 		proxyPath := c.Params("*")
 		proxy := NewReverseProxy(ds, proxyPath, targetUrl)
 		proxy.Transport = dataProxyTransport
@@ -113,3 +116,14 @@ func ProxyDataSourceRequest(c *middleware.Context) {
 		c.Resp.Header().Del("Set-Cookie")
 	}
 }
+
+func checkWhiteList(c *middleware.Context, host string) bool {
+	if host != "" && len(setting.DataProxyWhiteList) > 0 {
+		if _, exists := setting.DataProxyWhiteList[host]; !exists {
+			c.JsonApiErr(403, "Data proxy hostname and ip are not included in whitelist", nil)
+			return false
+		}
+	}
+
+	return true
+}