EnxDev commented on code in PR #37773: URL: https://github.com/apache/superset/pull/37773#discussion_r3976426432
########## superset/config.py: ########## @@ -2094,6 +2094,13 @@ def allowed_schemas_for_csv_upload( # pylint: disable=unused-argument FAB_API_KEY_ENABLED = False FAB_API_KEY_PREFIXES = ["sst_"] +# When False (default), the legacy FAB SSR admin password reset route +# (/superset/resetpassword) is not registered. The self-service password reset +# route (/superset/resetmypassword) is also skipped unless forced password +# changes are enabled, since that flow still needs a reachable reset form. +# Set to True to re-enable direct URL access to those views (e.g. during migration). +ENABLE_LEGACY_FAB_PASSWORD_VIEWS: bool = False Review Comment: **[P2] Please document the default route removal for upgrades.** Could we add an `UPDATING.md` entry for this change? Deployments that still link to `/superset/resetpassword` or `/superset/resetmypassword` will lose those routes after upgrading unless they opt back in with `ENABLE_LEGACY_FAB_PASSWORD_VIEWS = True`. The source comment explains the switch, but operators need that migration step somewhere they will see before an upgrade. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
