aminghadersohi commented on code in PR #43838:
URL: https://github.com/apache/superset/pull/43838#discussion_r4009539982
##########
superset/versioning/activity/render.py:
##########
@@ -192,6 +191,24 @@ def apply_record_decoration(
record["from_value"] = None
record["to_value"] = None
record["path"] = None
+ # ``impact`` is deliberately NOT redacted here — an explicit
+ # decision (review of #43838), recorded so this allowlist-by-
+ # omission is not mistaken for an oversight:
+ # * it names the charts on the *path* dashboard that pointed
+ # at the related entity at that transaction — the
+ # requester's own dashboard members, which
+ # ``raise_for_access`` already gated, and version history
+ # is itself edit-gated (sc-120001) — not the deleted entity
+ # or its editors, which is what this block withholds;
Review Comment:
Retracting this — my error. `sc-120001` is #44021, your own open PR, which
adds `is_editor` gating at `api_helpers.py:327` on the shared
`resolve_endpoint_path_entity` path. The clause is a forward reference, not a
false claim.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
