sadpandajoe commented on code in PR #45266:
URL: https://github.com/apache/superset/pull/45266#discussion_r4294483622
##########
superset/commands/dataset/create.py:
##########
@@ -225,6 +225,7 @@ def validate(self) -> None: # noqa: C901
sql=sql,
catalog=catalog,
schema=schema,
+ allow_editorship=False,
Review Comment:
This SQL check renders the statement without the dataset's
`template_params`, while the importer in this PR now forwards them
(`_config_template_params`), and `validate` already parses them a few lines up.
Someone with write access and `datasource_access` on only `public.orders` can
submit `SELECT * FROM {{ t | default('public.orders') }}` with
`template_params={"t": "private.secrets"}`; the check sees `public.orders`,
passes, and chart-data later renders `private.secrets` as the dataset's editor.
`UpdateDatasetCommand._validate_sql_access` and the legacy `/datasource/save/`
path have the same shape. Should these pass the submitted (or stored)
`template_params` to `raise_for_access` the way the import path does?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
