sha174n commented on code in PR #44494:
URL: https://github.com/apache/superset/pull/44494#discussion_r4066625432
##########
superset/commands/chart/update.py:
##########
@@ -166,9 +166,14 @@ def validate(self) -> None: # noqa: C901
if not self._model:
raise ChartNotFoundError()
- # Check and update editorship; when only updating query context we
relax
- # editorship so report workers can save context. We still require chart
- # access so users cannot rewrite query context for charts they cannot
access.
+ # Both a regular update and a query-context-only update require edit
+ # rights on the chart. A query-context-only update is the refreshed
+ # execution payload that Explore recomputes and saves in the
+ # background when a chart is opened; it is treated the same as the
+ # normal update path. Scheduled reports render the chart under an
Review Comment:
You are right, and I checked it: `get_executor` builds `editor_subject_ids`
from `model.editors` with the `ReportSchedule` as `model`, so
`ExecutorType.EDITOR` proves report editorship, not chart editorship, and a
`FixedExecutor` never qualifies. Reverted to `raise_for_access(chart=...)` and
added an explicit guest deny instead in d6284aa157, which keeps the `is_editor`
guest gap closed without touching the report backfill. The inaccurate comment
is gone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
