QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-19 05:05:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,755 Commits 535 Branches 558 Tags
2d7ea4cebbd8a3606586f2a1fa84db9e3d35bc39
Commit Graph

1025 Commits

Author SHA1 Message Date
Hugh A. Miles II
2d7ea4cebb Merge branch 'master' into hughhhh/dashboard-export-spec-review 2026-06-20 23:13:23 -04:00
Grégoire Gailly
cc9c20fcb6 feat(dashboard): Edit dashboard description from ui (and api) and show tooltip on dashboard list view (#36071) 2026-06-19 08:49:14 -07:00
Hugh A Miles II
667252a3fe Merge remote-tracking branch 'origin/master' into hughhhh/dashboard-export-spec-review 
# Conflicts:
#	UPDATING.md
 2026-06-17 09:22:10 -07:00
Amin Ghadersohi
eebe1a1a5b fix(dashboards): remove thumbnail_url from list API to reduce cache cost (#38567) 2026-06-17 09:35:21 -06:00
Joao Amaral
750518cf6f fix(celery): check app context before session removal in teardown (#37574) 
Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>
Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>
Co-authored-by: Daniel Vaz Gaspar <danielvazgaspar@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Elizabeth Thompson <eschutho@gmail.com>
 2026-06-17 10:44:27 -03:00
Xie Yanbo
a27ec1923e chore(export): Added ability to export chart YAML files with Unicode characters, fix #20331 (#28008) 
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 07:55:19 +01:00
Hugh A Miles II
a8c1148aad fix(dashboard): tolerate empty export_xlsx body + green up CI 
- export_xlsx: use request.get_json(silent=True) so a POST with no JSON
  content-type no longer raises 415/500 (returns 400/404/501 as intended).
- api_tests: register the FAB-generated can_export_xlsx permission in
  test_info_security_dashboard; replace the gamma test (Gamma has can_export)
  with a deterministic 404-for-inaccessible-dashboard check.
- type-annotate dict literals in the filter-context tests (mypy var-annotated).
- move MenuWrapperWithProps above first use (oxlint no-use-before-define).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-16 16:30:23 -07:00
Hugh A Miles II
161c4d81d7 Merge remote-tracking branch 'origin/master' into hughhhh/dashboard-export-spec-review 
# Conflicts:
#	UPDATING.md
#	superset-frontend/package-lock.json
 2026-06-16 15:59:03 -07:00
Hugh A Miles II
cea084898c feat(dashboard): POST export_xlsx endpoint 
Add POST /api/v1/dashboard/<pk>/export_xlsx/ which validates the request and
enqueues the async Excel export task, returning 202 with a job id. Gated on the
Dashboard can_export permission (@permission_name("export")); returns 501 when
EXCEL_EXPORT_S3_BUCKET is unset, 404 for inaccessible/missing dashboards,
403 on object-level access denial, and 400 for guest/no-email users or empty
dashboards. The job id is used as the Celery task id for correlation. Adds the
request/response marshmallow schemas and integration tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-16 14:48:34 -07:00
Amin Ghadersohi
c1b5d05f83 fix(bigquery): set default dataset from schema in adjust_engine_params (#40776) 2026-06-15 18:37:06 -04:00
Evan Rusackas
9d2f625e55 feat(encrypt): selectable encryption engine + AES-GCM re-encryption migrator (#40654) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-15 08:10:08 -07:00
Cezar
df0668eda5 feat(api): return uuid in POST response for dataset, chart, and dashboard (#37806) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-13 16:53:08 -07:00
Evan Rusackas
d120b1c250 feat(security): enforce password complexity policy (min length + common-password blocklist) (#40670) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-13 16:31:23 -07:00
Yuvraj Singh Chauhan
3c6239363b fix(db): preserve percent encoding in database passwords (#36783) 
Co-authored-by: Evan <evan@preset.io>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-13 13:52:00 -07:00
Shaitan
a41869ec7d fix(dashboard): build example-export sample data through the dataset query path (#40976) 
Co-authored-by: sha174n <pedro.sousa@preset.io>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-13 19:01:35 +01:00
Evan Rusackas
b05fe4857e fix(chart): require chart access for query_context-only updates (#40648) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-13 04:16:29 -07:00
Evan Rusackas
9938ee273f feat: terminate active sessions when an account is disabled (#40695) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-11 19:37:13 -07:00
Evan Rusackas
6c5ad1e912 fix(sqllab): apply SQL controls (RLS/DML/disallowed) to cost estimation (#40662) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-11 05:33:42 -07:00
Richard Fogaca Nienkotter
046b1b61b3 fix(maps): preserve OSM styles and configurable renderer defaults (#40804) 2026-06-10 22:26:00 -03:00
Evan Rusackas
00e3682aaf fix(dashboard): URL-encode native_filters in permalink redirect (#40660) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-09 11:37:08 -07:00
Evan Rusackas
a0cf798409 fix(embedded): add Sec-Fetch-Dest defense-in-depth check on the embedded view (#40667) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-09 11:08:08 -07:00
Evan Rusackas
065578e48a fix(commands,api): enforce command validation, sanitize export filename/token, set cache TTLs (#40655) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-09 10:29:46 -07:00
Evan Rusackas
bf9ad4d2ba fix: set charset via content_type to avoid malformed Content-Type headers (#40658) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-09 10:17:44 -07:00
Evan Rusackas
507cf93687 test(dashboard): API-created dashboards should link charts from position_json (#32966) (#40816) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-08 10:51:25 -07:00
Evan Rusackas
b85a2cdab1 fix: ODPS (MaxCompute) data source table preview failed (#38174) 
Co-authored-by: zhutong6688 <zhutong66@163.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
 2026-06-05 17:57:44 -07:00
Evan Rusackas
6b0d747939 fix: cache warmup using WebDriver for reliable authentication (#38449) 
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-05 16:36:30 -07:00
Evan Rusackas
1623ceda73 fix(result_set): preserve JSON/JSONB data as objects instead of strings (#38172) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-06-05 11:41:40 -07:00
Shaitan
41572dbf9d fix(chart): restrict owner lookup to users with write access (#39304) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 23:00:31 +01:00
Amin Ghadersohi
001834470b fix(mcp): escape LIKE wildcards in MCP list tool search filters (#40682) 2026-06-03 13:30:05 -04:00
Shaitan
b8a2f925ee fix(views): enforce per-chart access check in legacy form_data endpoint (#40497) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:56:03 +01:00
Shaitan
77c2bed5f7 fix(dashboards): narrow datasets payload to callers with read access (#40396) 
Co-authored-by: Claude Sonnet 4 <noreply@anthropic.com>
 2026-06-03 12:55:57 +01:00
Shaitan
3191b0fdcd fix: apply dashboard access check in related_objects endpoints (#40333) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:38 +01:00
Shaitan
f7f50a7977 fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:25 +01:00
Shaitan
725f5ed2a9 fix(api): enforce per-object ownership validation in chart, dataset, and report commands (#39303) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:15 +01:00
Evan Rusackas
fa41769a08 fix(embedded): enforce configured allowed domains for postMessage origin (#40629) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 22:58:30 -07:00
Shaitan
6eaee211aa fix(sqllab): require dataset match for raw query access (#40409) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 21:50:27 +01:00
Mehmet Salih Yavuz
e2ed989639 fix(reports): skip permalink when dashboard state has no anchor or filters (#40530) 2026-06-02 11:37:30 +03:00
Joe Li
a33fcb0edd feat: add embedded dashboard E2E tests to Playwright CI (#39300) 
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-06-01 09:42:08 -07:00
Shaitan
afc4f3c9b3 fix(database): extend URI blocklist to cover duckdb dialect (#40402) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-30 13:26:38 -07:00
Mike Bridge
7e088792b9 test(model): roll back uncommitted ds_col mutations in timestamp-expression tests (#40451) 
Co-authored-by: Mike Bridge <michael.bridge@ext.preset.io>
 2026-05-26 21:17:08 -03:00
Evan Rusackas
b23c65e04f test(charts): regression for last-modified sort order (#27500) (#40231) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-20 11:43:19 -07:00
Shaitan
69adecd6a3 fix(reports): enforce server-side recipient on chart/dashboard report subscriptions (#38847) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 10:36:42 -07:00
Evan Rusackas
53d5c41a72 test(security): regression test for session cookie after logout (#24713) (#40201) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-18 07:20:51 -07:00
Evan Rusackas
453f49ce33 test(api): regression test for Admin empty dashboard/chart list (#25890) (#40202) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-18 07:20:37 -07:00
Shaitan
407321e394 fix(database): extend shillelagh URI pattern to cover all driver variants (#39995) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-15 12:04:34 +01:00
Ville Brofeldt
af4dc3a9aa fix(re-encrypt): handle non-id PKs and make command idempotent (#40079) 2026-05-12 17:59:52 -07:00
Andy
a6ad0bf169 fix(re-encrypt-secrets): use db.Model.metadata to discover encrypted … (#39390) 
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-11 21:16:41 -07:00
Oleg Ovcharuk
d83b0c5ce3 feat: support creating datasets for schema-less databases (#39433) 
Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>
 2026-05-11 08:30:13 -04:00
Maxime Beauchemin
68fa8e2733 fix(viz): flatten MultiIndex columns in Time-Series Table for multiple Group By (#37869) 
Co-authored-by: Claude Opus 4 <noreply@anthropic.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
 2026-05-08 16:11:13 -07:00
Vitor Avila
3745e37182 fix(OAuth2): Support OAuth2 exception with legacy endpoint (#39897) 2026-05-05 21:21:48 -03:00