villebro opened a new pull request #17589: URL: https://github.com/apache/superset/pull/17589
### SUMMARY Adds a config flag `ENABLE_PUBLIC_ACTIVITY_ACCESS` that makes it possible to disable access to other users' recent activity data, both via the API and the profile page. In addition, a security manager method `raise_for_user_activity_access` is introduced to make it possible to fine tune who can and can't access recent activity data. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF When the flag is set to false, trying to access other users' activity data returns a 403 which is displayed on the profile page tables with the message "Access to user activity data is restricted" (in the screenshot the user is viewing another user's profile page):  With the default settings, accessing other users' activity data is allowed (current behavior unchanged):  ### TESTING INSTRUCTIONS 1. set `ENABLE_PUBLIC_ACTIVITY_ACCESS = False` in `superset_config.py` 2. login as `admin` 3. create a user `test` 3. go to `/superset/profile/test` 4. notice the message "Access to user activity data is restricted" in all activity tables 5. comment out `ENABLE_PUBLIC_ACTIVITY_ACCESS` flag in `superset_config.py` 6. go to `/superset/profile/test` 7. notice that access is unrestricted ### ADDITIONAL INFORMATION <!--- Check any relevant boxes with "x" --> <!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue --> - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
