QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-04-19 08:04:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Address dashboard permission regression in #23586 (#24350)

Browse Source
This commit is contained in:
John Bodley
2023-06-12 11:15:27 -07:00
committed by GitHub
parent c728cdf501
commit a3aacf2527
7 changed files with 166 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/integration_tests/dashboards/security/security_dataset_tests.py
View File

@@ -22,6 +22,7 @@ import pytest
from flask import escape
from superset import app
from superset.dashboards.dao import DashboardDAO
from superset.models import core as models
from tests.integration_tests.dashboards.base_case import DashboardTestCase
from tests.integration_tests.dashboards.consts import *
@@ -223,7 +224,7 @@ class TestDashboardDatasetSecurity(DashboardTestCase):
"""
admin = self.get_user("admin")
title = f"title{random_str()}"
create_dashboard_to_db(title, "slug1", owners=[admin])
dashboard = create_dashboard_to_db(title, "slug1", owners=[admin])
self.login(username="gamma")
arguments = {
@@ -234,3 +235,4 @@ class TestDashboardDatasetSecurity(DashboardTestCase):
self.assert200(rv)
data = json.loads(rv.data.decode("utf-8"))
self.assertEqual(0, data["count"])
DashboardDAO.delete(dashboard)

37
tests/integration_tests/dashboards/security/security_rbac_tests.py
View File

@@ -395,3 +395,40 @@ class TestDashboardRoleBasedSecurity(BaseTestDashboardSecurity):
# post
for dash in published_dashboards + draft_dashboards:
revoke_access_to_dashboard(dash, "Public")
def test_get_draft_dashboard_without_roles_by_uuid(self):
"""
Dashboard API: Test get draft dashboard without roles by uuid
"""
admin = self.get_user("admin")
dashboard = self.insert_dashboard("title", "slug1", [admin.id])
assert not dashboard.published
assert dashboard.roles == []
self.login(username="gamma")
uri = f"api/v1/dashboard/{dashboard.uuid}"
rv = self.client.get(uri)
assert rv.status_code == 200
# rollback changes
db.session.delete(dashboard)
db.session.commit()
def test_cannot_get_draft_dashboard_with_roles_by_uuid(self):
"""
Dashboard API: Test get dashboard by uuid
"""
admin = self.get_user("admin")
admin_role = self.get_role("Admin")
dashboard = self.insert_dashboard(
"title", "slug1", [admin.id], roles=[admin_role.id]
)
assert not dashboard.published
assert dashboard.roles == [admin_role]
self.login(username="gamma")
uri = f"api/v1/dashboard/{dashboard.uuid}"
rv = self.client.get(uri)
assert rv.status_code == 403
# rollback changes
db.session.delete(dashboard)
db.session.commit()