villebro commented on PR #44215: URL: https://github.com/apache/superset/pull/44215#issuecomment-6617418424
Reworked in 8bfcc785e1, following the legacy `DASHBOARD_RBAC` model. The review rounds kept finding write paths (attach, create, repoint, Save as, copy, MCP) that turned the dashboard inheritance into lasting access. Instead of opting each one out, the grant is now: - **for listed viewers of a published dashboard only**: editors keep their regular access, and guests keep their token grant; - **bound to that dashboard's requests**: chart data for a member chart on its own datasource, native filter, multi-layer child, drill, and the dashboard's chart list, `/charts` and `/datasets`. The request's `dashboardId` is validated against the chart, filter or datasource it names. Nothing outside those requests counts the grant, which removes the inheritance SQL, the context manager and the per-path opt-outs. Copying a dashboard now requires access to its charts. The description, `SECURITY.md`, the admin docs and `UPDATING.md` (which covers editors losing the grant) are updated. @sadpandajoe @madhushreeag @rusackas, could you take another look? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
