sadpandajoe commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4326644801
##########
superset/commands/report/base.py:
##########
@@ -217,6 +228,22 @@ def validate_chart_dashboard(
)
if not effective_chart and not effective_dashboard:
exceptions.append(ReportScheduleEitherChartOrDashboardError())
+ return
+
+ # The stored target has to answer the same question as a submitted
+ # one. Without this, an update that omits the target -- activating
a
+ # paused report, say -- resumes a schedule whose asset has since
+ # been withheld, while resubmitting that same asset is refused.
+ effective_kind, effective_id = (
+ ("chart", effective_chart)
+ if effective_chart
+ else ("dashboard", effective_dashboard)
+ )
+ target_id = getattr(effective_id, "id", effective_id)
+ if isinstance(target_id, int) and is_excluded_by_extra_access(
Review Comment:
This check also runs when the update only sets `active: false`. If a
report's dashboard or chart is later withheld via `report_target_*`, its
owner's pause request (`PUT /api/v1/report/<id>` with `{"active": false}`) now
returns 403, while the scheduler keeps selecting the active report and
delivering it. The check is also keyed only on `report_target_*`, so with just
`charts`/`dashboards` configured, `{"active": true}` on a report whose stored
chart was withheld is accepted, while resubmitting `{"chart": <id>}` is
refused. Should deactivation-only updates skip this check, and should the
stored target ask the same questions as a submitted one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
