mikebridge opened a new pull request, #45538: URL: https://github.com/apache/superset/pull/45538
### SUMMARY When a dashboard is saved, created or copied with a layout, Superset rebuilds the dashboard's chart list from the chart references in that layout. Those references weren't checked on the server, so a layout could add any chart to the dashboard. The server now accepts a chart the layout adds only if the user can read it. Charts already on the dashboard, archived ones included, are always accepted, so saving a dashboard you can edit keeps working even if it contains charts you couldn't add yourself. When copying, the source dashboard's own charts are accepted the same way. A layout that adds a chart the user can't read is rejected with a 422 that names the chart IDs, and nothing is saved. The check sits where the layout becomes the chart list (`DashboardDAO.set_dash_metadata`), so it covers dashboard update, create and copy, as well as the MCP tools that save layouts through the same path. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (API behaviour only). ### TESTING INSTRUCTIONS - `pytest tests/integration_tests/dashboards/api_tests.py -k layout_chart_access` - As a non-admin user who edits a dashboard: saving the dashboard as is, adding one of your own charts, and copying the dashboard all still work. A layout that references a chart you can't read is rejected with a 422, and the dashboard is unchanged. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
