EnxDev commented on code in PR #42472:
URL: https://github.com/apache/superset/pull/42472#discussion_r3673706863
##########
superset/daos/dashboard.py:
##########
@@ -429,11 +429,22 @@ def copy_dashboard(
raise DashboardForbiddenError()
dash = Dashboard()
+ # The copied dashboard and every chart cloned below share one creator,
+ # so both lookups are resolved here rather than inside the loop, where
+ # they would cost two extra queries for each chart in the dashboard.
+ creator_editors: list[Any] = []
+ creator_viewers: list[Any] = []
if g.user:
- from superset.subjects.utils import get_user_subject
+ from superset.subjects.utils import (
+ get_default_viewers_for_new_asset,
+ get_user_subject,
+ )
user_subject = get_user_subject(g.user.id)
- dash.editors = [user_subject] if user_subject else []
+ creator_editors = [user_subject] if user_subject else []
+ creator_viewers = get_default_viewers_for_new_asset(g.user.id)
+ dash.editors = creator_editors
+ dash.viewers = creator_viewers
Review Comment:
Intentional. When duplicate_slices=False the copy reuses the original Slice
objects, which are shared with the source dashboard (and any others embedding
them). Assigning the copier's creator-groups as viewers to those shared charts
would widen access to them everywhere they appear — a leak. A chart's own ACL
is independent of dashboard-level access by design (a dashboard can
legitimately contain charts a given viewer can't load — same nuance as the
VIEWER_PROMISCUOUS_MODE thread above). Only freshly-cloned charts
(duplicate_slices=True) inherit the creator's viewers, which is correct because
they're new objects.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
