EnxDev commented on code in PR #42472:
URL: https://github.com/apache/superset/pull/42472#discussion_r3661716250
##########
superset/commands/chart/importers/v1/utils.py:
##########
@@ -201,12 +203,29 @@ def import_chart(
if chart.id is None:
db.session.flush()
- if user:
- from superset.subjects.utils import get_user_subject
+ # Only newly created charts inherit the creator's editor/viewer defaults;
+ # re-importing over an existing chart (overwrite or soft-delete restore)
+ # must not silently grant the importer's groups access. Mirrors the
+ # dashboard importer's ``not existing`` guard.
+ if not existing and user:
Review Comment:
This is intentional, and good call on the `UPDATING.md` note; I've added it.
The `not existing` guard now also covers adding the importer as an editor,
matching the existing dashboard import behavior. This prevents
overwrite/soft-delete restore from silently granting editor access to the
importer.
In practice, this mainly affects an admin overwriting a chart they don't
already own. New chart imports are unchanged.
I've documented this as: **“v1 chart import no longer re-adds the importer
as editor on overwrite.”**
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
