Superset Dev 13af5cc865 fix(security): make user-registrations API admin-only and read-only ...

The REST counterpart of the "User Registrations" FAB view was never
added to ADMIN_ONLY_VIEW_MENUS, so role sync granted its list/get/
delete permissions to stock Gamma and Alpha, exposing pending
registrants' PII and letting non-admins cancel registrations. Add
"UserRegistrationsRestAPI" to the admin-only allowlist and restrict
the API to its GET/GET_LIST/INFO routes so write handlers are never
registered at all, even if the allowlist entry regresses later.

2026-08-21 00:44:50 -07:00

..

common

refactor: update Connection.execute() to use queries with text() (#40277)

2026-06-22 15:36:15 -07:00

consts

…

example_data

refactor: replace Engine.execute() with Connection.execute() (#41917)

2026-07-13 09:40:33 -07:00

fixtures

…

integration_tests

fix(tags): require ownership before bulk-deleting tags by name

2026-08-21 00:42:26 -07:00

unit_tests

fix(security): make user-registrations API admin-only and read-only

2026-08-21 00:44:50 -07:00

__init__.py

…

conftest.py

…