sha174n commented on code in PR #44080:
URL: https://github.com/apache/superset/pull/44080#discussion_r4062441247
##########
superset/views/datasource/views.py:
##########
@@ -121,25 +121,45 @@ def save(self) -> FlaskResponse:
except SupersetSecurityException as ex:
raise DatasetForbiddenError() from ex
- if database_id != orm_datasource.database_id:
+ # The request may repoint the dataset to a different database and/or a
+ # different table/schema/catalog; update_from_object (below) applies
+ # whatever the request supplies. Resolve the target of both dimensions
+ # up front so the access check is evaluated against what the dataset
+ # will actually point at, not its current (stale) values.
+ database_changed = database_id != orm_datasource.database_id
+ requested_table = Table(
+ datasource_dict.get("table_name", orm_datasource.table_name),
+ datasource_dict.get("schema", orm_datasource.schema),
+ datasource_dict.get("catalog", orm_datasource.catalog),
Review Comment:
Applied in d16ddd8 — plain `.get` with no fallback, so an omitted key reads
as the `None` that `update_from_object` actually writes. Follow-up in df17cab
scopes the check to physical targets (virtual datasets skip it, empty
schema/catalog normalised) so the stricter comparison does not fire on a plain
round-trip.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
