sha174n commented on code in PR #43992:
URL: https://github.com/apache/superset/pull/43992#discussion_r3959563171
##########
superset/views/sql_lab/views.py:
##########
@@ -153,7 +175,23 @@ def put(self, tab_state_id: int) -> FlaskResponse:
return Response(status=403)
try:
- fields = {k: json.loads(v) for k, v in
request.form.to_dict().items()}
+ fields = {
+ k: json.loads(v)
+ for k, v in request.form.to_dict().items()
+ if k in _TAB_STATE_PUT_FIELDS
+ }
Review Comment:
Not reproducible: the client double-encodes this field. `sqlEditorTabs.ts`
sends `extra_json: JSON.stringify({...})` (already a string), and `callApi`
then runs `JSON.stringify(value)` on each `postPayload` entry, so the form
value is a JSON-encoded string and `json.loads` yields a `str` for the Text
column. This is also unchanged from master, which applied `json.loads` to every
form field. Left as is.
##########
superset/views/sql_lab/views.py:
##########
@@ -172,9 +210,10 @@ def migrate_query(self, tab_state_id: int) ->
FlaskResponse:
return Response(status=403)
client_id = json.loads(request.form["queryId"])
- db.session.query(Query).filter_by(client_id=client_id).update(
- {"sql_editor_id": tab_state_id}
- )
+ db.session.query(Query).filter(
+ Query.client_id == client_id,
+ or_(Query.user_id == get_user_id(), Query.user_id.is_(None)),
+ ).update({"sql_editor_id": tab_state_id})
Review Comment:
Fixed in f7d532a318 - `migrate_query` now captures the rowcount and returns
404 when no query the caller may rebind matches the `client_id`, so
`migrateQuery` no longer applies a local state change on a backend no-op.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
