alexandrusoare commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4324784462
##########
superset/commands/report/base.py:
##########
@@ -142,6 +146,17 @@ def _check_object_access(
if not obj:
exceptions.append(not_found_exc())
else:
+ # The related-field filter narrows the picker, but a list filter is
+ # not an authorisation boundary: ``find_by_id`` above applies the
+ # ordinary access filter, so an excluded id posted directly would
+ # otherwise be accepted. Ask the report-target question here, where
+ # the id is actually resolved.
+ exclusion_kind = f"report_target_{kind}s"
+ if is_excluded_by_extra_access(exclusion_kind, object_id):
+ # An empty reason falls through to the class-level message.
+ raise ReportScheduleForbiddenError(
Review Comment:
Dropped the reason instead. You're right that 403s in this file don't carry
messages — response_403() takes no arguments anywhere
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
