dpgaspar commented on code in PR #23330:
URL: https://github.com/apache/superset/pull/23330#discussion_r1134505992
##########
superset/dashboards/dao.py:
##########
@@ -41,21 +42,31 @@ class DashboardDAO(BaseDAO):
@classmethod
def get_by_id_or_slug(cls, id_or_slug: Union[int, str]) -> Dashboard:
- query = (
- db.session.query(Dashboard)
- .filter(id_or_slug_filter(id_or_slug))
- .outerjoin(Slice, Dashboard.slices)
- .outerjoin(Slice.table)
- .outerjoin(Dashboard.owners)
- .outerjoin(Dashboard.roles)
- )
- # Apply dashboard base filters
- query = cls.base_filter("id", SQLAInterface(Dashboard,
db.session)).apply(
- query, None
- )
- dashboard = query.one_or_none()
+ try:
+ dashboard_id = int(id_or_slug)
+ # we only want to apply DashboardAccessFilter if getting by id
+ # since id is an int that can be easily iterate through
+ query = (
+ db.session.query(Dashboard)
+ .filter(id_or_slug_filter(dashboard_id))
+ .outerjoin(Slice, Dashboard.slices)
+ .outerjoin(Slice.table)
+ .outerjoin(Dashboard.owners)
+ .outerjoin(Dashboard.roles)
+ )
+ # Apply dashboard base filters
+ query = cls.base_filter("id", SQLAInterface(Dashboard,
db.session)).apply(
+ query, None
+ )
+ dashboard = query.one_or_none()
+ except ValueError:
+ # if it's slug or uuid, which is more specific, just get it
+ dashboard = Dashboard.get(id_or_slug)
Review Comment:
this will not apply any security settings in here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
