sadpandajoe commented on code in PR #43536:
URL: https://github.com/apache/superset/pull/43536#discussion_r4410400153
##########
superset/views/user_info.py:
##########
@@ -24,11 +24,21 @@
class UserInfoView(BaseSupersetView):
+ """SPA shell for the signed-in user's own profile page.
+
+ Uses ``can_userinfo on UserInfo`` rather than ``can_read on user`` /
+ ``User``. The latter is Admin-only (``ADMIN_ONLY_VIEW_MENUS``), so
+ Alpha/Gamma were redirected to ``/superset/welcome/`` when opening
+ Settings → Info even though the menu link is shown to every
+ authenticated user. ``can_userinfo`` is already in
+ ``ACCESSIBLE_PERMS``, so stock Gamma and Alpha receive it on role sync.
+ """
+
route_base = "/"
- class_permission_name = "user"
+ class_permission_name = "UserInfo"
Review Comment:
This moves `/user_info/` to `can_userinfo on UserInfo`, but
`_profile_page_reachable()` in `superset/security/password_change.py:192` still
checks `has_access("can_read", "user")`. With `ENABLE_FORCE_PASSWORD_CHANGE`
on, a flagged Gamma/Alpha user now holds the new permission but not the old
one, so the enforcement hook treats the profile page as unreachable and sends
them to logout instead of the password-change page (the very flow this page
serves). Should that check, its docstring, and the mocked case at
`tests/unit_tests/security/test_password_change.py:355` move to the new
permission in this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
