rusackas commented on PR #39469: URL: https://github.com/apache/superset/pull/39469#issuecomment-5006181510
Thanks @shantanukhond! CI's red right now (pre-commit plus the mysql/postgres/sqlite jobs), so that's step one. There's also a good number of unresolved bot findings on this one, and a handful read like real security concerns rather than nits. The timing differences in the failed-login path and the `session.commit()` calls inside the migration breaking Alembic's transaction boundary both stood out. Given this touches password hashing and session invalidation directly, I'd want those actually resolved (and tested) before we dig into review, not just acknowledged. EnxDev's question about remember-me sessions adopting the DB stamp without a fresh login also seems worth an answer. That reads like it could be a real auth bypass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
