alexandrusoare commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4325440576
##########
superset/charts/filters.py:
##########
@@ -123,6 +124,13 @@ def apply(self, query: Query, value: Any) -> Query:
if (guest_dashboards := guest_embedded_dashboard_filter()) is not None:
return query.filter(self.model.dashboards.any(guest_dashboards))
+ # Applied before the short-circuit below: an exclusion has to hold for
+ # principals who can reach every dataset, since those are exactly the
+ # ones the role paths stop narrowing. Guests are excepted above --
+ # their token already scopes them, and withholding here would strip
+ # charts from a dashboard they were legitimately granted.
+ query = apply_extra_access_exclusions(query, "charts", Slice.id)
Review Comment:
Intended. Failing the bundle for an unreadable related chart is existing
behaviour — a non-admin exporting a dashboard with a chart they can't read
already gets ChartNotFoundError from the count mismatch. Admins were only
exempt because ChartFilter short-circuits on can_access_all_datasources(), and
applying exclusions before that is the point of the hook.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
