aminghadersohi commented on code in PR #43838:
URL: https://github.com/apache/superset/pull/43838#discussion_r4009418446
##########
superset/versioning/activity/render.py:
##########
@@ -192,6 +191,24 @@ def apply_record_decoration(
record["from_value"] = None
record["to_value"] = None
record["path"] = None
+ # ``impact`` is deliberately NOT redacted here — an explicit
+ # decision (review of #43838), recorded so this allowlist-by-
+ # omission is not mistaken for an oversight:
+ # * it names the charts on the *path* dashboard that pointed
+ # at the related entity at that transaction — the
+ # requester's own dashboard members, which
+ # ``raise_for_access`` already gated, and version history
+ # is itself edit-gated (sc-120001) — not the deleted entity
+ # or its editors, which is what this block withholds;
Review Comment:
This path is read-gated, not edit-gated: `@permission_name("get")`
(dashboards/api.py:2871) + `raise_for_access` (api_helpers.py:297), and
`raise_for_editorship` is absent under `superset/versioning/`. `sc-120001`
appears nowhere else in the tree.
```suggestion
# * it names the charts on the *path* dashboard that
pointed
# at the related entity at that transaction — the
# requester's own dashboard members, which
# ``raise_for_access`` already gated — not the deleted
# entity or its editors, which is what this block
# withholds;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
