EnxDev commented on code in PR #45342:
URL: https://github.com/apache/superset/pull/45342#discussion_r4353670967
##########
superset/commands/explore/get.py:
##########
@@ -83,10 +83,14 @@ def _authorize_datasource(
# the query at all. The author bypass returns before the generic
# ``datasource`` perm check at the tail of ``raise_for_access``,
# so this does not weaken anything for anyone else.
+ #
+ # Editorship stays off for everyone else: a dataset named after a
+ # table the query reads is a decoy any dataset creator can make.
security_manager.raise_for_access(
query=datasource,
datasource=datasource,
allow_query_authorship_bypass=True,
+ allow_editorship=False,
Review Comment:
Confirmed, and fixed in b0488780a5. This was open on master for any
datasource type, not just queries: with `slice_id` set the GET only ran the
chart check, so a `form_data` override could also return another dataset's SQL
and metadata.
Chart access now only authorizes the chart's own datasource. When
`form_data` names a different one, the chart check still runs and that
datasource then gets the same check it gets without a chart: a query goes
through the authorship bypass with editorship off, a dataset through
`datasource=`. I went with checking it rather than requiring the two to match,
so someone who switches a saved chart to another dataset they can read still
gets the Explore page.
Tests: a query and a dataset that aren't the chart's own each get their own
check, and a test through `GetExploreCommand.run()` with your URL shape (a
readable chart plus `form_data` pointing at a query) is denied. All three fail
without the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
