sha174n commented on PR #41430: URL: https://github.com/apache/superset/pull/41430#issuecomment-5602432976
Thanks for the follow-up. On the current branch both `runtime_schema` and `views` already call `layer.raise_for_access()` right after the `find_by_uuid()` lookup (api.py 743-746 and 804-807), each returning 403 on failure (with the 403 documented in the route spec). That came in with the latest master merge, so the same guard now applies on those two paths as everywhere else. The net-new part left in this PR is the command-layer `raise_for_access` on create/update/delete. Let me know if there's anything else you'd like tightened before merge. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
