alexandrusoare commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4325436144
##########
superset/commands/report/base.py:
##########
@@ -142,6 +143,13 @@ def _check_object_access(
if not obj:
exceptions.append(not_found_exc())
else:
+ # The related-field filter narrows the picker, but a list filter is
+ # not an authorisation boundary: ``find_by_id`` above applies the
+ # ordinary access filter, so an excluded id posted directly would
+ # otherwise be accepted. Ask the report-target question here, where
+ # the id is actually resolved.
+ if is_excluded_by_extra_access(f"report_target_{kind}s",
object_id):
Review Comment:
Right, the stored target wasn't checked. Fixed in that branch, which already
has the effective ids. Two tests: refused when withheld, allowed when not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
