villebro commented on PR #44215: URL: https://github.com/apache/superset/pull/44215#issuecomment-6588945287
@madhushreeag, thanks, confirmed and fixed in f2b559120b. The layout check counted chart access inherited through another dashboard, so a viewer of A could attach A's chart to their own dashboard B, and that membership outlived the viewer grant (the editor leg isn't gated on `published`). The chart branch of `raise_for_access` now honors `allow_dashboard_inheritance`, `can_access_chart` accepts it, and `_raise_for_unreadable_new_charts` passes `False`. Only independently granted chart access counts for attaching a chart; reading through the dashboard is unchanged. `test_chart_readable_only_through_a_dashboard_cannot_be_attached_elsewhere` reproduces your scenario against real rows: it didn't raise before this change and is refused now, while the inherited read still works. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
