msyavuz commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4324982167
##########
superset/daos/dashboard.py:
##########
@@ -422,6 +423,13 @@ def get_by_id_or_slug(cls, id_or_slug: int | str) ->
Dashboard:
if is_uuid(id_or_slug):
# just get dashboard if it's uuid
dashboard = Dashboard.get(id_or_slug)
+ # This branch skips ``base_filter``, so an
+ # ``EXTRA_ACCESS_QUERY_EXCLUSIONS`` entry -- which reaches the
+ # id branch below through that filter -- would not apply here, and
+ # the same dashboard would be absent by id while readable by uuid.
+ # Withheld means withheld whichever identifier names it.
+ if dashboard and is_excluded_by_extra_access("dashboards",
dashboard.id):
Review Comment:
`is_excluded_by_extra_access` has no guest check, so an embedded guest who
fetches a dashboard by UUID gets a 404 for a dashboard their token grants, even
though `DashboardAccessFilter` (and the docs) exempt guests from exclusions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
