alexandrusoare commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4324060979
##########
superset/commands/explore/get.py:
##########
@@ -63,8 +63,21 @@ def _authorize_datasource(
routing below is testable without a request context.
"""
if slc:
+ # Chart access, and then the dataset in its own right. Access to a
+ # chart is not access to everything else in its dataset: Explore is a
+ # query builder, so opening it over a dataset the user cannot read
+ # hands them its full column and metric list and a UI for composing
+ # queries the saved chart never ran. Deployments that grant chart
+ # access by other means -- dashboard RBAC, or an
+ # ``EXTRA_RAISE_FOR_ACCESS_BYPASS`` hook -- reach this path with no
+ # dataset grant of their own, and the chart check alone let it pass.
security_manager.raise_for_access(chart=slc)
- elif isinstance(datasource, Query):
+ _raise_for_datasource(datasource)
Review Comment:
Moot now that the Explore change is out — with it gone there's no
user-visible behaviour change left; both hooks are no-ops when unset. Happy to
add an entry for the new config keys on their own if you think they warrant one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
