mikebridge commented on PR #45535: URL: https://github.com/apache/superset/pull/45535#issuecomment-6373655251
_AI-assisted reply on Mike's behalf._ @fitzee: fixed the layout gap in 468b0945c2. After repair and parent rebuilding, generation checks every layout node with the DAO's chart-ID coercion, and refuses references outside the access-checked `chart_ids` before creating the dashboard. The five cases you listed failed before the guard and pass with it, and all 70 existing generation tests still pass. - Clarified the `permission_denied` guidance. Chart denial can't be bypassed. Dashboard-edit denial can offer a new dashboard, but only after confirmation, and chart access is still checked. - Checked `add_chart_to_existing_dashboard`. It adds one checked chart to the stored layout and accepts no caller-provided `position_json`. It doesn't scrub older inconsistent layouts. - Left the deleted-dataset wording and the `GenerateDashboardResponse` discriminator as follow-ups, so this fix keeps the authorization order and response shape unchanged. @gabotorresruiz: thanks for reproducing it. The guard covers detached nodes and string or float IDs too. The eager-load removal and the existing query-count test are unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
