QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-04-19 16:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): add granular export controls (Phase 1) (#38361)

Browse Source
This commit is contained in:
Hugh A. Miles II
2026-03-09 16:44:56 -04:00
committed by GitHub
parent 9017b9a74f
commit 61fbfda501
14 changed files with 387 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
superset/security/manager.py
View File

@@ -280,6 +280,11 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
"Datasource",
} | READ_ONLY_MODEL_VIEWS
GAMMA_EXCLUDED_PVMS = {
("can_export_data", "Superset"),
("can_export_image", "Superset"),
}
ADMIN_ONLY_VIEW_MENUS = {
"Access Requests",
"Action Logs",
@@ -396,6 +401,8 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
SQLLAB_EXTRA_PERMISSION_VIEWS = {
("can_csv", "Superset"), # Deprecated permission remove on 3.0.0
("can_export_data", "Superset"),
("can_copy_clipboard", "Superset"),
("can_read", "Superset"),
("can_read", "Database"),
}
@@ -1195,6 +1202,9 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
self.add_permission_view_menu("all_database_access", "all_database_access")
self.add_permission_view_menu("all_query_access", "all_query_access")
self.add_permission_view_menu("can_csv", "Superset")
self.add_permission_view_menu("can_export_data", "Superset")
self.add_permission_view_menu("can_export_image", "Superset")
self.add_permission_view_menu("can_copy_clipboard", "Superset")
self.add_permission_view_menu("can_share_dashboard", "Superset")
self.add_permission_view_menu("can_share_chart", "Superset")
self.add_permission_view_menu("can_sqllab", "Superset")
@@ -1476,6 +1486,7 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
or self._is_admin_only(pvm)
or self._is_alpha_only(pvm)
or self._is_sql_lab_only(pvm)
or (pvm.permission.name, pvm.view_menu.name) in self.GAMMA_EXCLUDED_PVMS
) or self._is_accessible_to_all(pvm)
def _is_sql_lab_only(self, pvm: PermissionView) -> bool: