You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "jingapore (via GitHub)" <gi...@apache.org> on 2023/05/08 13:12:08 UTC

[GitHub] [superset] jingapore opened a new issue, #23969: ChartFilter filters on datasource instead of chart

jingapore opened a new issue, #23969:
URL: https://github.com/apache/superset/issues/23969

   ChartFilter [here](https://github.com/apache/superset/blob/cfc70ea8b0bbb73a5d7189c26867bb64f6f80f67/superset/charts/filters.py#L89) should filter on chart access, **not** datasource access.
   
   This has downstream implications:
   - A newly added dashboard owner who did not create the underlying datasource cannot edit chart. It fails with a 404 error, because chart isn't found. This links to #20381.
   - This behaviour is unintended. After all, [dashboard ownership comes with chart ownership](https://github.com/apache/superset/blob/cfc70ea8b0bbb73a5d7189c26867bb64f6f80f67/superset/dashboards/commands/update.py#L59).
   - This is partly a result of how[ `ChartDAO.find_by_id` relies on ChartFilter](https://github.com/apache/superset/blob/cfc70ea8b0bbb73a5d7189c26867bb64f6f80f67/superset/explore/utils.py#L87), which mistakenly checks for datasource ownership.
   
   The correct thing is hence for chart access to be separated from datasource access. **ChartFilter needs to be amended.**


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] ChartFilter filters on datasource instead of chart [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #23969: ChartFilter filters on datasource instead of chart
URL: https://github.com/apache/superset/issues/23969


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

[GitHub] [superset] SaviorXTanren commented on issue #23969: ChartFilter filters on datasource instead of chart

Posted by "SaviorXTanren (via GitHub)" <gi...@apache.org>.
SaviorXTanren commented on issue #23969:
URL: https://github.com/apache/superset/issues/23969#issuecomment-1542947916

   To add to this, the same sort of logic is present in the Datasets list. When a user visits the Datasets list page, it shows all Datasets of the Datasources that the user has access to. So users will be able to see Datasets that they do not have permission and it will fail for them when they attempt to navigate to any of them.
   
   Similarly, visiting a Dataset that you don't have access to will expose the names of the columns in the dataset, even though you don't have access to query on it.
   
   There should be a trickle down check done on these sorts of pages. For example, if you go to Charts list, it should check first to see what Datasources you have access to, and then individually check the Charts in those Datasources to ensure you have access to each one before it is shown in the list. Same sort of idea for Datasets, Dashboards, etc.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] ChartFilter filters on datasource instead of chart [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23969:
URL: https://github.com/apache/superset/issues/23969#issuecomment-1967320401

   This is likely fixed by now, and is pretty out of date if not. If people are still encountering this in current versions (3.x) please open a new Issue or a PR to address the problem, or add a reproducible example here so we can re-open this one.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org