QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-08-12 11:11:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Allow embedded guest user datasource access with dashboard context (#25081)

Browse Source
This commit is contained in:
Jack Fragassi
2023-08-28 09:48:21 -07:00
committed by GitHub
parent b240b795b5
commit 2b8d8da22a
6 changed files with 277 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
superset/security/manager.py
+8 -2
View File
@@ -1882,17 +1882,23 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
or self.is_owner(datasource)
or (
# Grant access to the datasource only if dashboard RBAC is enabled
# or the user is an embedded guest user with access to the dashboard
# and said datasource is associated with the dashboard chart in
# question.
form_data
and is_feature_enabled("DASHBOARD_RBAC")
and (dashboard_id := form_data.get("dashboardId"))
and (
dashboard_ := self.get_session.query(Dashboard)
.filter(Dashboard.id == dashboard_id)
.one_or_none()
)
and dashboard_.roles
and (
(is_feature_enabled("DASHBOARD_RBAC") and dashboard_.roles)
or (
is_feature_enabled("EMBEDDED_SUPERSET")
and self.is_guest_user()
)
)
and (
(
# Native filter.