rusackas commented on code in PR #43391:
URL: https://github.com/apache/superset/pull/43391#discussion_r3870964145
##########
superset/security/manager.py:
##########
@@ -1613,6 +1754,17 @@ def query_context_modified(query_context:
"QueryContext") -> bool:
# Use ``is not None`` so an empty-but-present stored context reads as
present.
stored_context_state = "present" if stored_query_context is not None else
"missing"
+ # Reject result types that would have the server expand the query to raw
+ # datasource rows regardless of the stored chart's columns and metrics.
+ if _result_type_modified(query_context, stored_query_context):
Review Comment:
Good catch — fixed in d3a0e36. Native-filter requests now reject
`samples`/`drill_detail` result types outright: those preparers swap in every
datasource column regardless of the requested list, so they need to be blocked
before the allowlist check rather than validated by it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
