alexandrusoare commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4324792949
##########
superset/charts/filters.py:
##########
@@ -123,6 +124,13 @@ def apply(self, query: Query, value: Any) -> Query:
if (guest_dashboards := guest_embedded_dashboard_filter()) is not None:
return query.filter(self.model.dashboards.any(guest_dashboards))
+ # Applied before the short-circuit below: an exclusion has to hold for
+ # principals who can reach every dataset, since those are exactly the
+ # ones the role paths stop narrowing. Guests are excepted above --
+ # their token already scopes them, and withholding here would strip
+ # charts from a dashboard they were legitimately granted.
+ query = apply_extra_access_exclusions(query, "charts", Slice.id)
Review Comment:
Four tests added: the exclusion surviving can_access_all_datasources() on
ChartFilter and is_admin() on DashboardAccessFilter, and an embedded guest
bypassing it on each
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
