EnxDev commented on code in PR #43988:
URL: https://github.com/apache/superset/pull/43988#discussion_r3959499050
##########
superset/models/slice.py:
##########
@@ -496,13 +496,36 @@ def set_related_perm(_mapper: Mapper, _connection:
Connection, target: Slice) ->
# pylint: disable=import-outside-toplevel
from superset.daos.datasource import DatasourceDAO
- src_class = DatasourceDAO.sources[target.datasource_type]
+ # This listener also runs on updates, so clear the derived values before
+ # attempting to resolve the datasource. Otherwise an unmapped or deleted
+ # datasource can retain permission strings copied from a previous one.
+ target.perm = None
Review Comment:
This is intentional. The permission strings are not the only access check:
`ChartFilter` first short-circuits for users with `can_access_all_datasources`,
then ORs the editor and viewer clauses before reaching the permission-based
fallback.
Both that fallback and `_apply_legacy` also join `Slice.datasource_id` to
`SqlaTable`. If the datasource has been deleted, the chart is excluded by the
join regardless of any stored permission values, so keeping stale permissions
would not preserve its visibility.
Clearing them protects against the inverse case: if a chart is updated to
use an unmapped datasource type, retaining the existing values would leave it
associated with the previous datasource’s permissions. The chart could then
remain readable through permissions for a datasource it no longer references.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
