sha174n opened a new pull request, #42205:
URL: https://github.com/apache/superset/pull/42205
### SUMMARY
The unversioned ("v0") dashboard and dataset import paths create or update
nested objects without checking that the caller may write those object types:
- the legacy dashboard import upserts the datasets embedded in the export,
and
- the legacy dataset import upserts the database connections embedded in the
export,
relying only on the top-level import permission.
This aligns those paths with the versioned (v1) import commands by requiring
the nested object type's own write permission before creating or updating it:
dataset write permission for the datasets embedded in a dashboard export, and
database write permission for the database connections embedded in a dataset
export. The check is only enforced when a request user is present, so the
command-line import paths (which run without a request user) keep working
unchanged.
### TESTING INSTRUCTIONS
pytest tests/unit_tests/dashboards/commands/importers/v0/import_test.py \
tests/unit_tests/datasets/commands/importers/v0/import_test.py
They cover: a user without the relevant write permission is refused and the
nested upsert is not called; a permitted user proceeds; and the no-request-user
(CLI) path skips the check and proceeds.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
