You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by GitBox <gi...@apache.org> on 2020/10/29 17:51:54 UTC
[GitHub] [incubator-superset] ktmud opened a new issue #11490: Anyone can now edit any one's chart
ktmud opened a new issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490
A clear and concise description of what the bug is.
### Expected results
Users should only be able to edit charts they created or own.
### Actual results
When you try to edit chart properties for a chart that you don't own, there is an error message:
<img src="https://user-images.githubusercontent.com/335541/97610097-ae6a6680-19d1-11eb-9518-c25dfc42decf.png" width="500">
But when you save an existing chart that you don't own, from the "Run/Save" button, you can proceed without any blocker:
<img src="https://user-images.githubusercontent.com/335541/97610323-f7221f80-19d1-11eb-911a-eda7fa3e8e1b.png" width="500">
Previously even thought the backend API may still pass, at least "Save (Overwrite)" is disabled on the frontend.
We need backend security check anywhere the charts may be updated.
#### How to reproduce the bug
See description
### Environment
(please complete the following information):
- superset version: `superset version`
- python version: `python --version`
- node.js version: `node -v`
- npm version: `npm -v`
### Checklist
Make sure these boxes are checked before submitting your issue - thank you!
- [ ] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [ ] I have reproduced the issue with at least the latest released version of superset.
- [ ] I have checked the issue tracker for the same issue and I haven't found one similar.
### Additional context
#11381 doesn't seem to be the cause of the bug but could be related.
cc @zuzana-vej @junlincc
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] graceguo-supercat edited a comment on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
graceguo-supercat edited a comment on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719042119
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] nytai commented on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
nytai commented on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719023493
It certainly could be due to that, superset's permissions can be really confusing. I'm not sure how this would result in the button no longer being greyed out as that's a frontend change (I would think). @ktmud do you know around when (or which commit) had the behavior with the greyed out/disabled option?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] willbarrett closed issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
willbarrett closed issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] graceguo-supercat commented on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
graceguo-supercat commented on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719041499
frontend logic depends on the can_edit flag passed in bootstrap data.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] graceguo-supercat commented on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
graceguo-supercat commented on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719042119
this is a very dangerous bug, right now everyone can accidentally overwrite chart that has no overwrite permission.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] willbarrett commented on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
willbarrett commented on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719056199
Fixed via revert.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] issue-label-bot[bot] commented on issue #11490: Anyone can now edit any one's chart
Posted by GitBox <gi...@apache.org>.
issue-label-bot[bot] commented on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-718919755
Issue-Label Bot is automatically applying the label `#bug` to this issue, with a confidence of 0.78. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: [app homepage](https://github.com/marketplace/issue-label-bot), [dashboard](https://mlbot.net/data/apache/incubator-superset) and [code](https://github.com/hamelsmu/MLapp) for this bot.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] graceguo-supercat edited a comment on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
graceguo-supercat edited a comment on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719042119
this is a very dangerous bug, right now everyone can accidentally overwrite chart that he/she has no overwrite permission. There are a few places read this flag: inline edit title, save chart properties from Modal, and Save chart modal.
We should revert this change.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] graceguo-supercat edited a comment on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
graceguo-supercat edited a comment on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719042119
this is a very dangerous bug, right now everyone can accidentally overwrite chart that he/she has no overwrite permission. There are a few places need this flag: inline edit title, save chart properties from Modal, and Save chart modal. We should revert this change.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] ktmud commented on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
ktmud commented on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719018454
Could be #11335
cc @nytai @lilykuang
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [incubator-superset] graceguo-supercat edited a comment on issue #11490: Anyone can now edit anyone's chart
Posted by GitBox <gi...@apache.org>.
graceguo-supercat edited a comment on issue #11490:
URL: https://github.com/apache/incubator-superset/issues/11490#issuecomment-719041499
frontend logic depends on the can_edit flag passed from bootstrap data.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org