villebro commented on PR #44215: URL: https://github.com/apache/superset/pull/44215#issuecomment-6620603658
@madhushreeag, thanks, confirmed and fixed in 687ac32e1f, following your suggestion. Saving a native filter now requires access to any datasource it newly targets, mirroring the chart layout check: - through the dashboard (`PUT` and create, via `set_dash_metadata`; the update command refuses before its report side effects); - through the filters API (`PUT /api/v1/dashboard/<id>/filters`, which the MCP `manage_native_filters` tool also uses). Targets the dashboard already had stay accepted, so a save never fails over a filter it doesn't change. Copying a dashboard also requires access to the source's filter targets, since the copy keeps them. `test_carrying_charts_or_filter_targets_onto_a_dashboard_takes_access` covers both save paths, the existing-target case and copy against real rows; the new-target case wasn't refused before this change. SECURITY.md and UPDATING.md are updated. Dashboard imports aren't covered: like chart attachment in #45538, they're an import-permission path, not an editor save. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
