mirror of
https://github.com/apache/superset.git
synced 2026-09-08 08:14:56 +00:00
Superset Dev
816b98f876
ReportExecutionLogRestApi declared no base_filters, so the only scoping on its list/item routes was the caller-chosen schedule pk folded into the rison filters -- any role with generic ReportSchedule read could iterate every schedule's logs, including alert result values and database error messages for schedules it doesn't own. Add ReportExecutionLogFilter, scoping directly on ReportExecutionLog.report_schedule_id (mirroring ReportScheduleFilter on the sibling schedule API), and apply it as a base filter on both routes.