sadpandajoe commented on code in PR #43340:
URL: https://github.com/apache/superset/pull/43340#discussion_r3867501245
##########
superset/dashboards/api.py:
##########
@@ -1795,6 +1801,14 @@ def export_xlsx(self, pk: int) -> WerkzeugResponse:
):
return self.response_404()
+ # The webdriver cannot render under a guest identity: the export would
+ # hold the shared guest lock for its whole budget and produce nothing.
+ # The UI hides the option for guests, but hiding is not enforcement.
+ if payload.get("mode") == "images" and
security_manager.is_guest_user():
Review Comment:
The UI hides image export whenever `userId` is absent, but this rejects only
guest-token users; a Public/anonymous requester can still POST `mode=images`
directly. Could this use the same no-user-id predicate (or otherwise align the
two gates) so an anonymous export cannot occupy the shared lock and fail in the
webdriver path?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
