Evan
be0d9bc9e3
fix(embedded): include all_columns from stored query context in guest sort targets
...
Address review feedback: the stored query context loop in
_collect_sortable_identifiers omitted all_columns, silently rejecting
legitimate guest sorts on table charts configured with 'show all
columns'. Add it, plus a regression test and clarifying comments on the
order-by union and the intentional stored_values asymmetry.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-23 05:51:00 -07:00
Evan
7c1fa4ae72
fix(embedded): include legacy singular metric and reject malformed orderby in guest sort guard
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-18 23:00:13 -07:00
Claude Code
27c481d75d
fix(embedded): allow guest users to sort table columns
...
query_context_modified() compared a guest request's orderby against the
stored chart's orderby with a strict subset check, alongside columns,
metrics and groupby. Saved charts usually store an empty orderby, so when
a guest clicked a column header to sort a table in an embedded dashboard
the new orderby value failed the subset check and the request was
rejected with "Guest user cannot modify chart payload", even though
sorting only changes result ordering and not which data is read.
Handle orderby separately: a guest may sort by any column or metric the
stored chart already references, but order-by terms that are not present
in the stored chart (e.g. a free-form random() expression) are still
rejected, preserving the existing SQL-injection guard. The columns/
metrics/groupby comparison is extracted into a helper to keep
query_context_modified within the complexity budget, and the inner loop's
variable shadowing of `key` is fixed along the way.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-18 21:46:53 -07:00
Evan Rusackas
e16bb29faf
fix(embedded): allow guests to apply a Time Grain native filter ( #32768 ) ( #41017 )
...
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-06-15 15:22:21 -07:00
Shaitan
aa3d2b9e81
fix(dashboard): validate native-filter data requests against filter targets ( #40979 )
...
Co-authored-by: sha174n <pedro.sousa@preset.io >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-13 19:02:28 +01:00
Evan Rusackas
814b72c6f9
feat(security): force password change on first use (opt-in) ( #40669 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-06-11 22:23:10 -07:00
Michael Gerber
041ecbc248
fix(embedded): resolve guest user permissions in user_view_menu_names ( #39197 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-06-01 10:30:05 -07:00
Mehmet Salih Yavuz
95f61bd223
fix: add parent_slice_id for multilayer charts to embed ( #38243 )
2026-03-12 21:21:43 +03:00
Kamil Gabryjelski
3e3c9686de
perf(dashboard): Batch RLS filter lookups for dashboard digest computation ( #37941 )
2026-02-16 21:35:55 +01:00
Alexandru Soare
9ea5ded988
fix(dashboard): Prevent fatal error when database connection is unavailable ( #37576 )
2026-02-06 20:52:17 -08:00
Daniel Vaz Gaspar
a9fb853e3e
fix: Bump FAB to 5.X ( #33055 )
...
Co-authored-by: Joe Li <joe@preset.io >
2025-09-12 09:21:37 +01:00
Maxime Beauchemin
246181a546
feat(docker): Add pytest support to docker-compose-light.yml ( #34373 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2025-08-06 00:17:50 -04:00
Maxime Beauchemin
3f8472ca7b
chore: move some rules from ruff -> pylint ( #34292 )
2025-07-24 09:40:49 -07:00
Beto Dealmeida
a26e1d822a
chore: remove sqlparse ( #33564 )
2025-06-04 19:31:41 -04:00
Maxime Beauchemin
e51b95ffa8
chore: enforce more ruff rules ( #31447 )
...
Co-authored-by: Elizabeth Thompson <eschutho@gmail.com >
2024-12-18 17:41:34 -08:00
Beto Dealmeida
7f2e752796
fix: check orderby ( #31156 )
2024-11-26 10:15:06 -05:00
Geido
90572be95a
fix(Dashboard): Retain colors when color scheme not set ( #30646 )
2024-11-21 19:58:32 +02:00
Beto Dealmeida
e0172a24b8
fix(embedded): sankey charts ( #30491 )
2024-10-02 13:45:35 -04:00
Beto Dealmeida
39209c2b40
fix: handle empty catalog when DB supports them ( #29840 )
2024-08-13 10:08:43 -04:00
Beto Dealmeida
fb15278f97
fix: catalog permission check ( #29581 )
2024-07-12 21:00:13 -04:00
Beto Dealmeida
a56f656a83
fix: small fixes to the catalog migration ( #29579 )
2024-07-12 20:49:30 -04:00
Beto Dealmeida
67df4e3ce3
fix: prevent guest users from changing columns ( #29530 )
2024-07-10 12:26:51 -04:00
John Bodley
8fb8199a55
chore(dao/command): Add transaction decorator to try to enforce "unit of work" ( #24969 )
2024-06-28 12:33:56 -07:00
Beto Dealmeida
8e15d4807f
chore: s/MockFixture/MockerFixture/g ( #29160 )
2024-06-10 12:35:07 -04:00
Beto Dealmeida
ba2cf5dbbc
chore: unit tests for catalog_access ( #28406 )
2024-05-09 14:41:33 -04:00
Beto Dealmeida
e90246fd1f
feat(SIP-95): permissions for catalogs ( #28317 )
2024-05-06 11:41:58 -04:00
Beto Dealmeida
36290ce72f
fix: guest queries ( #27566 )
2024-03-19 11:20:52 -04:00
Beto Dealmeida
376bfd05bd
fix: pass valid SQL to SM ( #27464 )
2024-03-18 15:38:58 -04:00
Beto Dealmeida
36fd3c0bf8
feat: improve _extract_tables_from_sql ( #26748 )
2024-03-18 13:02:58 -04:00
Beto Dealmeida
735b895dd5
fix: check if guest user modified query ( #27484 )
2024-03-12 21:28:06 -04:00
Daniel Vaz Gaspar
5b34395689
fix: chart import validation ( #26993 )
2024-02-06 12:14:02 +00:00
Beto Dealmeida
fade4806ce
fix: prevent guest user from modifying metrics ( #26749 )
2024-01-29 12:59:33 -05:00
Beto Dealmeida
42e8d1b498
chore: improve schema security ( #23385 )
2023-03-17 08:05:50 -07:00
Beto Dealmeida
1b95da7487
fix: table schema permissions ( #23356 )
2023-03-14 15:18:18 -07:00
