Raman-Katiyar opened a new pull request, #46047:
URL: https://github.com/apache/superset/pull/46047
### SUMMARY
Fixes #46003.
With dashboard RBAC, a role assigned to a dashboard implicitly grants read
access to the dashboard's charts and their datasources. Opening one of those
charts in Explore still failed for me: `GET /api/v1/explore/` returned 403 for
a user who holds that dashboard role but no dataset permission — a regression
from the 4.0.x behaviour described in the issue.
The Explore bootstrap authorizes the saved chart and then checks the chart's
datasource without any context, so the dashboard-membership grant in
`raise_for_access` could never apply on this path (the chart branch had no
dashboard-viewer leg either).
What I changed:
- `SupersetSecurityManager.raise_for_access` accepts an optional `form_data`
for datasource checks that do not arrive through a query context or viz object.
Only the chart identity (`slice_id`) is consumed.
- The datasource branch now grants access when the user can view a
**published** dashboard containing the chart, and only when the requested
datasource is verified to be that chart's own datasource. Chart-data requests
are excluded from this leg — they carry a `dashboardId` (and `parent_slice_id`
for multi-layer charts) and keep using the existing, precise dashboard grant.
- The chart branch likewise honours viewers of a published dashboard
containing the chart, mirroring the viewers leg of the dashboard branch,
including the published gate.
- `GetExploreCommand` passes the saved chart's `slice_id` when it authorizes
a datasource that differs from the chart's own.
The per-datasource check added for CVE-2025-55675 is not weakened: a user
with neither dashboard access nor dataset permission is still denied, and the
new tests below cover both directions.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Not applicable — backend authorization change only, no UI changes. Before: a
dashboard-role viewer opening a dashboard chart in Explore got a 403 and a
blank Explore page. After: the same request returns 200 with the chart's form
data.
### TESTING INSTRUCTIONS
New regression tests in
`tests/integration_tests/explore/dashboard_rbac_api_tests.py` build a dataset,
a chart, and a published dashboard whose only viewer is a role with no data
permissions (Gamma's permissions minus all database/schema/datasource grants):
- `test_explore_allows_dashboard_rbac_viewer` — the dashboard-role viewer
opens the chart in Explore: HTTP 200, correct `form_data.datasource` and slice.
**On unmodified master this test fails with `assert 403 == 200`** (the reported
bug); with this change it passes.
- `test_explore_command_denies_user_without_access` — a user with neither
dashboard access nor dataset permission is denied by `GetExploreCommand` with
`SupersetSecurityException`. (Asserted at the command layer because
`get_form_data` drops charts the user cannot access, so the HTTP layer serves
an empty bootstrap shell for `slice_id`-only requests; the denial is enforced
in the command.)
- `test_explore_http_denies_dataset_only_request_from_outsider` — the same
outsider requesting a dataset directly over HTTP gets 403, exercising the
CVE-2025-55675 check end to end.
Results:
- New tests: 3 passed (1 failed / 2 passed on unmodified master, as above).
- `tests/unit_tests/security`, `tests/unit_tests/subjects`,
`tests/unit_tests/commands/explore`: all pass (961 tests together with the new
integration file). One existing mock expectation in
`test_get_query_authorship_bypass.py` was updated because the authorized call
now carries `form_data={"slice_id": ...}`.
- `tests/integration_tests/explore`: no new failures — the 8 failures / 11
errors in that suite are identical on unmodified master in my local environment
(they rely on seeded users/services my local test DB does not provide).
- Pre-commit passes on all changed files (ruff, ruff-format, mypy, pylint).
Could a maintainer please approve the CI workflows for this PR? Thank you.
### ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes #46003
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
