zephyring commented on code in PR #23330:
URL: https://github.com/apache/superset/pull/23330#discussion_r1134516982
##########
superset/dashboards/dao.py:
##########
@@ -41,21 +42,31 @@ class DashboardDAO(BaseDAO):
@classmethod
def get_by_id_or_slug(cls, id_or_slug: Union[int, str]) -> Dashboard:
- query = (
- db.session.query(Dashboard)
- .filter(id_or_slug_filter(id_or_slug))
- .outerjoin(Slice, Dashboard.slices)
- .outerjoin(Slice.table)
- .outerjoin(Dashboard.owners)
- .outerjoin(Dashboard.roles)
- )
- # Apply dashboard base filters
- query = cls.base_filter("id", SQLAInterface(Dashboard,
db.session)).apply(
- query, None
- )
- dashboard = query.one_or_none()
+ try:
+ dashboard_id = int(id_or_slug)
+ # we only want to apply DashboardAccessFilter if getting by id
+ # since id is an int that can be easily iterate through
+ query = (
+ db.session.query(Dashboard)
+ .filter(id_or_slug_filter(dashboard_id))
+ .outerjoin(Slice, Dashboard.slices)
+ .outerjoin(Slice.table)
+ .outerjoin(Dashboard.owners)
+ .outerjoin(Dashboard.roles)
+ )
+ # Apply dashboard base filters
+ query = cls.base_filter("id", SQLAInterface(Dashboard,
db.session)).apply(
+ query, None
+ )
+ dashboard = query.one_or_none()
+ except ValueError:
+ # if it's slug or uuid, which is more specific, just get it
+ dashboard = Dashboard.get(id_or_slug)
Review Comment:
the check from security manager will still apply at below, as the base
defense line, even though we have the cls.base_filter applied on int id.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
