msyavuz commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4335198204
##########
superset/commands/report/base.py:
##########
@@ -142,6 +146,13 @@ def _check_object_access(
if not obj:
exceptions.append(not_found_exc())
else:
+ # The related-field filter narrows the picker, but a list filter is
+ # not an authorisation boundary: ``find_by_id`` above applies the
+ # ordinary access filter, so an excluded id posted directly would
+ # otherwise be accepted. Ask the report-target question here, where
+ # the id is actually resolved.
+ if is_excluded_by_extra_access(f"report_target_{kind}s",
object_id):
Review Comment:
This check raises even when the update sets `active: false`. The report edit
modal resends the stored `chart`/`dashboard` id with every save, so an owner
who pauses a report on a withheld target from that modal still gets a 403, and
the pause exemption in `_check_stored_target_access` only helps callers that
send `{"active": false}` alone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
