bito-code-review[bot] commented on PR #43402: URL: https://github.com/apache/superset/pull/43402#issuecomment-5374091051
<!-- Bito Reply --> The security concern is valid. The current implementation retrieves reports without applying the necessary permission filters, which can lead to the disclosure of report names to users who do not have access to them. To resolve this, the `build_blocked_by_reports_message` function should be updated to filter the reports based on the current user's permissions before constructing the error message. Since I do not have direct access to the file system to modify the code, I recommend updating the command to fetch only the reports the user is authorized to see, or alternatively, checking permissions for each report before including its name in the message. Would you like me to fetch all other comments on this PR to see if there are other issues that need attention? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
