QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-13 18:25:58 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,347 Commits 529 Branches 555 Tags
80ea36c852fc7c0b2daeee4bddc30c037d7ef2ed
Commit Graph

2894 Commits

Author SHA1 Message Date
Evan Rusackas
80ea36c852 fix(db_engine_specs): escape schema name in regex; document safe filter pattern (#40642) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-03 11:56:51 -07:00
Amin Ghadersohi
f4dfb7f026 fix(mcp): fall back to form_data spatial query for Deck.gl charts (#40339) 2026-06-03 13:30:52 -04:00
Amin Ghadersohi
001834470b fix(mcp): escape LIKE wildcards in MCP list tool search filters (#40682) 2026-06-03 13:30:05 -04:00
Burhanuddin Mundrawala
e5ff6de790 chore: correct typos in config.py and models_test.py comments (#40706) 2026-06-03 21:58:29 +07:00
Shaitan
e3ba85b1a5 fix(redirect): normalize browser-stripped whitespace before protocol-relative check (#40566) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:56:10 +01:00
Shaitan
b8a2f925ee fix(views): enforce per-chart access check in legacy form_data endpoint (#40497) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:56:03 +01:00
Shaitan
77c2bed5f7 fix(dashboards): narrow datasets payload to callers with read access (#40396) 
Co-authored-by: Claude Sonnet 4 <noreply@anthropic.com>
 2026-06-03 12:55:57 +01:00
Shaitan
56fd991efd fix(dataset): unify validation for stored and adhoc SQL expressions (#40392) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:55:50 +01:00
Shaitan
3191b0fdcd fix: apply dashboard access check in related_objects endpoints (#40333) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:38 +01:00
Shaitan
f7f50a7977 fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:25 +01:00
Shaitan
725f5ed2a9 fix(api): enforce per-object ownership validation in chart, dataset, and report commands (#39303) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:15 +01:00
Shaitan
faa76f6741 fix(embedding): add optional dataset allowlist to guest tokens (#39302) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:09 +01:00
Shaitan
8e4a460cc7 fix(charts): apply DISALLOWED_SQL_FUNCTIONS gate to adhoc expressions (#40568) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:52:22 +01:00
Evan Rusackas
b9dc9d722e fix(export): sanitize user-supplied CSV export filename (charts + SQL Lab) (#40632) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-03 00:14:48 -07:00
Evan Rusackas
fa41769a08 fix(embedded): enforce configured allowed domains for postMessage origin (#40629) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 22:58:30 -07:00
Evan Rusackas
12bef03f4a fix(jinja): apply consistent escaping to url_param values from request args (#40633) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:23:48 -07:00
Evan Rusackas
0b9764aed5 fix(mcp): honor AUTH_ROLE_ADMIN and warn on permission-less protected tools (#40659) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:20:11 -07:00
Evan Rusackas
ac522ded1c fix(ssh-tunnel): validate server_address format (SSRF defense-in-depth) (#40665) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:19:24 -07:00
Evan Rusackas
9af6746dbe fix(models): HTML-escape data-controlled values in dashboard_link and Slice.icons (#40639) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 16:15:11 -07:00
Evan Rusackas
6abee0289b fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state (#40657) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 15:09:14 -07:00
Shaitan
6eaee211aa fix(sqllab): require dataset match for raw query access (#40409) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 21:50:27 +01:00
Evan Rusackas
3e589436fa fix(reports): sanitize error text in email notification template (#40641) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 13:40:10 -07:00
Evan Rusackas
8508af3201 chore(key_value): prune expired entries from the key-value store (#40663) 
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Ville Brofeldt <ville.v.brofeldt@gmail.com>
 2026-06-02 12:36:32 -07:00
Amin Ghadersohi
616c243278 fix(deps): revert joserfc JWT error migration — fastmcp still uses authlib (#40688) 2026-06-02 12:02:17 -07:00
Evan Rusackas
b97d3ef520 fix(api,sql): use json_response in Api.query and log dialect fallback (#40644) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:46 -07:00
Evan Rusackas
4d2b10d916 chore(excel): strip document metadata from Excel exports (#40661) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:36 -07:00
Evan Rusackas
242c27a974 test(presto): 401 Unauthorized must surface as CONNECTION_ACCESS_DENIED_ERROR (#33554) (#40618) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:49:58 -07:00
Evan Rusackas
1632b235ae fix(sqllab): surface stacktrace in SQL Lab error responses (#28248) (#40585) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:41:39 -07:00
Evan Rusackas
093b43c7a5 fix(exports,email,logs): csv formula escaping, subject CRLF stripping, UTC log pruning (#40645) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 18:32:36 +01:00
Durgaprasad M L
4996d7c277 fix: avoid warning spam when default spinner SVG is missing (#40481) 
Co-authored-by: Sam Firke <sfirke@users.noreply.github.com>
 2026-06-02 10:26:37 -07:00
jesperct
699e741c69 fix(time-comparison): shift offset filter when X-axis is adhoc Custom SQL (#40586) 2026-06-02 09:52:42 -07:00
Evan Rusackas
ca8855dc03 fix(mcp): generic auth errors, required token expiry, and safer auth logging (#40646) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 08:31:05 -07:00
Mehmet Salih Yavuz
e2ed989639 fix(reports): skip permalink when dashboard state has no anchor or filters (#40530) 2026-06-02 11:37:30 +03:00
Evan Rusackas
c6faa50338 fix(cli): encrypt sqlalchemy_uri password on import_datasources (#31983) (#40584) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 22:08:48 -07:00
Evan Rusackas
817a35f445 fix(mcp): deny deactivated user accounts in MCP authentication (#40631) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-01 22:08:29 -07:00
Amin Ghadersohi
a6d2c95480 chore(deps): migrate MCP service JWT errors from authlib.jose to joserfc (#40582) 2026-06-02 00:41:17 -04:00
dependabot[bot]
1523d797ca chore(deps-dev): bump pyinstrument from 4.4.0 to 5.1.2 (#40377) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Evan <evan@preset.io>
 2026-06-01 13:34:12 -07:00
Evan Rusackas
dab628c13a fix(i18n): auto-add ASF license header in backfill_po.py (#40395) 
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 11:53:35 -07:00
Amin Ghadersohi
5312d0adf8 feat(mcp): add list_reports and get_report_info tools (#40348) 
Co-authored-by: Richard Fogaça <richardfogaca@gmail.com>
 2026-06-01 14:23:53 -04:00
Michael Gerber
041ecbc248 fix(embedded): resolve guest user permissions in user_view_menu_names (#39197) 
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-01 10:30:05 -07:00
Joe Li
a33fcb0edd feat: add embedded dashboard E2E tests to Playwright CI (#39300) 
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-06-01 09:42:08 -07:00
jesperct
a2eda11a81 fix(dataset): validate catalog against allow_multi_catalog on import (#40376) 2026-06-01 09:24:28 -07:00
Shaitan
63249c8c97 fix(chart): add regression coverage for UpdateChartCommand ownership (#39997) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 09:15:38 -07:00
Hugh A. Miles II
9a79588d35 feat(dashboard): add Rison-encoded URL filter support (#39795) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-31 08:06:09 -04:00
Shaitan
afc4f3c9b3 fix(database): extend URI blocklist to cover duckdb dialect (#40402) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-30 13:26:38 -07:00
Amin Ghadersohi
87be424f9c feat(mcp): add list and get tools for row level security and plugins (#40347) 2026-05-30 10:41:12 -04:00
Evan Rusackas
7f54b0b13d test(database): regression test for sqla engine creation (#27897) (#40237) 
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-29 21:47:49 -07:00
Amin Ghadersohi
d350792d43 feat(mcp): add list and get tools for CSS templates and themes (#40343) 2026-05-30 00:20:48 -04:00
Amin Ghadersohi
62b4ee3d9e feat(mcp): add list and get tools for users and roles (#40345) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-29 23:46:30 -04:00
Amin Ghadersohi
40de44f6de feat(mcp): add list and get tools for action log and tasks (#40344) 2026-05-29 23:16:10 -04:00