EnxDev commented on code in PR #37773: URL: https://github.com/apache/superset/pull/37773#discussion_r3976428105
########## superset/config.py: ########## @@ -2076,6 +2076,13 @@ def allowed_schemas_for_csv_upload( # pylint: disable=unused-argument FAB_API_KEY_ENABLED = False FAB_API_KEY_PREFIXES = ["sst_"] +# When False (default), the legacy FAB SSR admin password reset route +# (/superset/resetpassword) is not registered. The self-service password reset +# route (/superset/resetmypassword) is also skipped unless forced password +# changes are enabled, since that flow still needs a reachable reset form. +# Set to True to re-enable direct URL access to those views (e.g. during migration). +ENABLE_LEGACY_FAB_PASSWORD_VIEWS: bool = False Review Comment: I agree this needs upgrade-path coverage as part of the fix. Could we seed an existing `ResetPasswordView` permission/view-menu, run the normal role sync, and assert that it is removed or at least not reassigned when the flag is false? That would verify the behavior for persisted installations, not only a freshly initialized app where the view was never registered. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
