sha174n opened a new pull request, #43992: URL: https://github.com/apache/superset/pull/43992
### SUMMARY `TabStateView.put` updated the tab state from the entire request body via `Query.update(dict(request.form))`. It now writes only a fixed set of client-updatable columns (the fields the SQL Lab editor auto-sync sends), so identity columns such as `user_id` are not taken from the request and the tab state stays bound to its creating user. A `latest_query_id` is accepted when it references the caller's own query (or an unowned one) and dropped when it points at a query owned by a different user. `migrate_query` likewise rebinds only a query owned by the caller (or unowned). ### TESTING INSTRUCTIONS `pytest tests/unit_tests/views/test_sql_lab_tab_state_views.py`. Adds regression tests: columns outside the allowlist are ignored, `latest_query_id` referencing another user's query is dropped, and `migrate_query` rebinds only the caller's own query. ### ADDITIONAL INFORMATION - [ ] Has associated issue - [x] Required feature flags: n/a - [x] Changes UI - [ ] Includes DB Migration - [x] Migration is atomic, supports rollback & is backwards-compatible - [x] Confirm DB upgrade/downgrade tested - [x] Runtime consequences 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
