Abdulrehman-PIAIC80387 commented on issue #43257: URL: https://github.com/apache/superset/issues/43257#issuecomment-5352977323
@dosu — the bug **is** on `master`, not just 6.1.0. Verified against the current `upstream/master` HEAD (fetched fresh): [`superset/dashboards/filter_state/api.py`](https://github.com/apache/superset/blob/master/superset/dashboards/filter_state/api.py) ``` Line 21: from flask_appbuilder.security.decorators import has_access_api Line 52: @has_access_api ← on post() Line 60: def post(self, pk: int) -> Response: Line 177: @has_access_api ← on put() Line 185: def put(self, pk: int, key: str) -> Response: ``` `get()` (L240) and `delete()` (L285) don't carry `@has_access_api`, which matches the reporter's observation that GET/DELETE work while POST/PUT return 401. The decorator ordering issue @sig-rnd-io-testuser described (`@has_access_api` running before `@protect()` can hydrate `current_user`) reproduces at HEAD. Happy to open a PR removing the decorator from `post()` and `put()` so they match the working shape of `get()` and `delete()` — @sadpandajoe let me know if that's the direction you want. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
