[GitHub] [superset] zephyring commented on a diff in pull request #23330: fix: revert back to use security manager authz for dashboard when get by uuid

["zephyring (via GitHub)" <gi...@apache.org>]

zephyring commented on code in PR #23330:
URL: https://github.com/apache/superset/pull/23330#discussion_r1134516982


##########
superset/dashboards/dao.py:
##########
@@ -41,21 +42,31 @@ class DashboardDAO(BaseDAO):
 
     @classmethod
     def get_by_id_or_slug(cls, id_or_slug: Union[int, str]) -> Dashboard:
-        query = (
-            db.session.query(Dashboard)
-            .filter(id_or_slug_filter(id_or_slug))
-            .outerjoin(Slice, Dashboard.slices)
-            .outerjoin(Slice.table)
-            .outerjoin(Dashboard.owners)
-            .outerjoin(Dashboard.roles)
-        )
-        # Apply dashboard base filters
-        query = cls.base_filter("id", SQLAInterface(Dashboard, db.session)).apply(
-            query, None
-        )
-        dashboard = query.one_or_none()
+        try:
+            dashboard_id = int(id_or_slug)
+            # we only want to apply DashboardAccessFilter if getting by id
+            # since id is an int that can be easily iterate through
+            query = (
+                db.session.query(Dashboard)
+                .filter(id_or_slug_filter(dashboard_id))
+                .outerjoin(Slice, Dashboard.slices)
+                .outerjoin(Slice.table)
+                .outerjoin(Dashboard.owners)
+                .outerjoin(Dashboard.roles)
+            )
+            # Apply dashboard base filters
+            query = cls.base_filter("id", SQLAInterface(Dashboard, db.session)).apply(
+                query, None
+            )
+            dashboard = query.one_or_none()
+        except ValueError:
+            # if it's slug or uuid, which is more specific, just get it
+            dashboard = Dashboard.get(id_or_slug)

Review Comment:
   the check from security manager will still apply at below, as the base defense line, even though we have the cls.base_filter applied on int id.
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org