bito-code-review[bot] commented on code in PR #41897:
URL: https://github.com/apache/superset/pull/41897#discussion_r3547833075
##########
superset/subjects/filters.py:
##########
@@ -176,6 +176,28 @@ def apply(self, query: Query, value: Optional[Any]) ->
Query:
return _apply_subject_list_filters(query)
+class SubjectAllTextFilter(BaseFilter): # pylint:
disable=too-few-public-methods
+ """ILIKE search across a subject's textual columns.
+
+ Used by the Subject REST API ``search_filters`` for free-text search.
+ """
+
+ name = _("All Text")
+ arg_name = "subject_all_text"
+
+ def apply(self, query: Query, value: Any) -> Query:
+ if not value:
+ return query
+ ilike_value = f"%{value}%"
+ return query.filter(
+ or_(
+ Subject.label.ilike(ilike_value),
+ Subject.secondary_label.ilike(ilike_value),
+ Subject.extra_search.ilike(ilike_value),
+ )
+ )
Review Comment:
<!-- Bito Reply -->
The suggestion is appropriate because it addresses a potential security and
consistency issue. By bypassing the established `_apply_subject_list_filters()`
method, the new filter fails to enforce necessary permission and exclusion
checks that are applied to all other filters in the file. Applying this
suggestion ensures that the new search functionality respects the same access
control patterns as the rest of the application.
**superset/subjects/filters.py**
```
def apply(self, query: Query, value: Any) -> Query:
if not value:
return query
# Suggestion: Call _apply_subject_list_filters(query) here
ilike_value = f"%{value}%"
return query.filter(
or_(
Subject.label.ilike(ilike_value),
Subject.secondary_label.ilike(ilike_value),
Subject.extra_search.ilike(ilike_value),
)
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
