sadpandajoe commented on code in PR #43391:
URL: https://github.com/apache/superset/pull/43391#discussion_r3910387925
##########
superset/security/manager.py:
##########
@@ -876,6 +879,19 @@ def _native_filter_request_modified(query_context:
"QueryContext") -> bool:
# intentionally deny every value-returning term below.
allowed_columns, allowed_metrics = targets
+ # The samples/drill_detail preparers replace a query's columns with every
+ # column on the datasource - bypassing the target-column allowlist below
+ # entirely - so reject those result types outright; a native filter never
+ # legitimately needs them.
+ if any(
Review Comment:
This only blocks requests that identify themselves as native filters. A
guest can omit those client-controlled markers while requesting `samples`; the
chartless drill-access branch still permits the dashboard datasource and the
samples preparer expands it to every column. Could this reject row-expanding
result types for guest chartless requests unless a server-side drill flow
explicitly authorizes them?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
