rusackas commented on PR #39255: URL: https://github.com/apache/superset/pull/39255#issuecomment-4997283420
Thanks @TryingtoLiveInTech, nice quality-of-life win! One of the bot threads is still open and worth addressing before this merges. Namely, the slice_id lookup for the filename bypasses the chart's access filters, so someone could infer the name of a chart they can't otherwise view, through the export filename. Codeant and Copilot both flagged this independently, so it may be worth fetching the slice through ChartDAO with the base filters applied instead of a raw session.get. There are also a couple of smaller bot notes worth a look while you're at it (the broad exception handling around that lookup and a tz-naive datetime call). Thanks! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
