dimm-hristov commented on PR #38831:
URL: https://github.com/apache/superset/pull/38831#issuecomment-5104323981
@villebro @betodealmeida I think this PR introduced a bug in the reset
password functionality.
What we've noticed is that the reset password functionality is not working
properly since it was saving the new password directly as plain string in the
database. After this the user can't login with the new password.
The password should be hashed.
Commit 33f0fc93ed — PR #38831 "feat: introduce Subject model and entity
editors/viewers" by villebro, merged 2026-07-08.
```
That PR was an unrelated refactor (part of introducing a Subject model /
entity editors feature) that touched CurrentUserRestApi.update_me and replaced
the manual
attribute loop with a call to UserDAO.update():
- for key, value in item.items():
- setattr(g.user, key, value)
-
self.pre_update(g.user, item)
+ UserDAO.update(item=g.user, attributes=item)
db.session.commit()
Before this change, the order was: apply raw attributes via setattr first,
then pre_update hashes the password last, overwriting whatever was set —
correct.
After this change, pre_update hashes the password first (onto g.user
directly), and then UserDAO.update re-applies the original, still-unhashed
attributes dict via
its own generic setattr loop afterward, clobbering the hash with the
plaintext — introducing the regression.
Your fork imported Apache Superset's source as a single squashed commit on
2026-07-13 (45c33c0), five days after that upstream PR merged, so the bug was
already
baked into the code your fork started from — it wasn't something
introduced by any T212-specific customization. It's currently still present on
apache/superset's
master branch too, so it may be worth reporting upstream.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
