sha174n commented on code in PR #44494:
URL: https://github.com/apache/superset/pull/44494#discussion_r4072425077
##########
superset/commands/chart/update.py:
##########
@@ -181,6 +185,12 @@ def validate(self) -> None: # noqa: C901
exceptions.append(ex)
raise_if_managed_externally(self._model, ChartForbiddenError)
else:
+ # ``raise_for_access`` admits a guest for every chart on the
+ # dashboard its token embeds, and a guest holds no write
+ # capability, so deny explicitly. The regular update path gets this
+ # from ``is_editor``, which never treats a guest as an editor.
+ if security_manager.is_guest_user():
+ raise ChartForbiddenError()
try:
security_manager.raise_for_access(chart=self._model)
Review Comment:
Not applicable as written. Scoping this branch to report executors was the
original shape of the PR and was reverted after review: `get_executor` resolves
`ExecutorType.EDITOR` against the `ReportSchedule`, not the chart
(`superset/tasks/utils.py:92`), and `THUMBNAIL_EXECUTORS` defaults to
`CURRENT_USER`, so neither executor is reliably a chart editor. Requiring edit
rights here left `query_context` NULL and broke CSV/Excel reports.
`raise_for_access(chart=...)` is the intended gate on this path, matching
what the endpoint already required. The one principal it admitted without a
corresponding write capability was the embedded guest, which is what the
explicit deny above covers.
Covered by `test_query_context_update_denies_guest` in
`tests/integration_tests/charts/commands_tests.py`, which now drives a real
guest token and asserts the guest clears `raise_for_access` first, so the deny
provably comes from this check. Tightened in 0501e78b3a.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
