Superset Dev
13af5cc865
fix(security): make user-registrations API admin-only and read-only
...
The REST counterpart of the "User Registrations" FAB view was never
added to ADMIN_ONLY_VIEW_MENUS, so role sync granted its list/get/
delete permissions to stock Gamma and Alpha, exposing pending
registrants' PII and letting non-admins cancel registrations. Add
"UserRegistrationsRestAPI" to the admin-only allowlist and restrict
the API to its GET/GET_LIST/INFO routes so write handlers are never
registered at all, even if the allowlist entry regresses later.
2026-08-21 00:44:50 -07:00
Evan Rusackas and Claude Code
13d38a9cbd
test(security): assert intended trailing-slash behavior of security API ( #29934 ) ( #41965 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-07-15 22:24:15 -07:00
4b9b8187b3
fix(config): make Swagger UI opt-in (off by default) ( #41300 )
...
Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-06-25 10:34:28 -07:00
Evan Rusackas and Claude Code
0fd244b5c6
fix(security): reject unknown fields on guest-token RLS rules ( #41217 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-06-24 16:16:43 -07:00
Beto Dealmeida
cb53745d43
feat: semantic layer extension ( #37815 )
2026-05-05 12:07:46 -04:00
Daniel Vaz Gaspar and Claude Opus 4.6
5815665cc6
feat: role/user CRUD events and login/logout tracking in the action log ( #39121 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-04-09 15:55:25 +01:00
811dcb3715
feat(api-keys): add API key authentication via FAB SecurityManager ( #37973 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
Co-authored-by: Kamil Gabryjelski <kamil.gabryjelski@gmail.com >
2026-03-24 13:37:26 -04:00
Daniel Vaz Gaspar
a4bb11c755
chore: bump FAB to 4.7.0 ( #33607 )
2025-05-29 08:34:00 +01:00
Enzo Martellucci
013379eb86
feat(List Users): Migrate List Users FAB to React ( #32882 )
2025-04-15 17:04:28 +03:00
Enzo Martellucci and Diego Pucci
4f0020d0df
feat(List Roles): Migrate FAB view to React ( #32432 )
...
Co-authored-by: Diego Pucci <diegopucci.me@gmail.com >
2025-04-02 14:06:17 +03:00
Daniel Vaz Gaspar
ceda51617b
fix: CSRF exempt unit_tests ( #27168 )
2024-02-20 16:18:30 +00:00
Daniel Vaz Gaspar
549abb542b
fix: REST API CSRF exempt list ( #25590 )
2023-10-10 12:53:37 +01:00
Superset Dev