You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "mdeshmu (via GitHub)" <gi...@apache.org> on 2023/07/24 11:41:55 UTC
[GitHub] [superset] mdeshmu opened a new issue, #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard/chart
mdeshmu opened a new issue, #24782:
URL: https://github.com/apache/superset/issues/24782
Folks,
Sorry, but I am confused & annoyed with this behavior which I have described below.
We are using DASHBOARD_RBAC to give read-only dashboard access to users without giving them any access to charts, datasets, and databases. We have assigned only the default Gamma role to the user.
Here are the two issues we are observing:
1) In 2.1.0, 3.0.0rc1, and in the current master, a Gamma user can save a copy of a dashboard not owned by them. More importantly, they can make copies of all charts in the dashboard with the "also copy (duplicate) charts" checkbox. This is very undesired and a maintenance nightmare for us.
2) They can edit the chart from the dashboard and "save as" a new chart, even though the chart is not owned by them.
The irony is, Gamma users can't list any charts from the Charts Menu (including cloned charts). An admin can see that charts are being cloned.
This was reported by another user here as well: https://apache-superset.slack.com/archives/CCKHMGRRB/p1688356037634189
This behavior didn't exist in 1.5.3. Is this a deliberately added behavior or is it a bug with DASHBOARD_RBAC?
### Expected results
Gamma users who are not owners of the dashboard shouldn't be able to save a dashboard.
Gamma users who are not owners of the charts shouldn't be able to edit a chart from the dashboard and should not be able to save it as a new chart from the chart builder.
### Actual results
Gamma users can save a dashboard and chart even if they are not owners.
#### Screenshots
Added above.
### Environment
- browser type and version: Version 114.0.5735.134 (Official Build) (64-bit)
- superset version: 3.0.0rc1
- python version: 3.9.x
- node.js version: NA
- any feature flags active: This feature flags are set to true ->
ALERT_REPORTS, DASHBOARD_CROSS_FILTERS, DASHBOARD_RBAC, GENERIC_CHART_AXES, ALLOW_FULL_CSV_EXPORT, DRILL_TO_DETAIL, HORIZONTAL_FILTER_BAR
### Checklist
Make sure to follow these steps before submitting your issue - thank you!
- [ ] I have checked the superset logs for Python stack traces and included them here as text if there are any.
- [ x] I have reproduced the issue with at least the latest released version of the superset.
- [x ] I have checked the issue tracker for the same issue and haven't found one similar.
### Additional context
NA
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] mdeshmu commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "mdeshmu (via GitHub)" <gi...@apache.org>.
mdeshmu commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1650863271
@john-bodley Really appreciate your effort (series of PRs) to extensively address the issues I have raised here.
IMO, In this case, A user should not be able to open a chart in Explore by clicking on the chart title in the dashboard.
Do you already have an open PR to address this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] betodealmeida commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1648716848
> is the _intended_ behavior that by adding an RBAC role than users of said role are _only_ allowed to see the charts (and access the data backing said charts) in the controlled context of the dashboard, i.e., they should not be able to either explore it, save it (via save-as), or directly access the underlying dataset?
I think in theory yes, that was in the intention, but in practice it might've been too complicated to implement it this way and the access just "cascades".
(I'm not super familiar with dashboard RBAC since we don't use it.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] john-bodley commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "john-bodley (via GitHub)" <gi...@apache.org>.
john-bodley commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1650952905
@mdeshmu https://github.com/apache/superset/pull/24789 partially addresses the issue, i.e., though the link will exist when they click through they'll be denied access to the underlying dataset. I'll likely work on a follow up PR which actually results in a redirect to ensure consistent behavior with the dashboard workflow when a user is denied access.
Note the challenge is currently we (many of the committers) don't have a good sense on what the actual desired UX was—the unit/integration tests which initially failed due to my change indicates that chart exploration was viable, albeit the issues surfaced in this issue. I'm hoping that @villebro can provide some additional context on the situation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] mdeshmu commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "mdeshmu (via GitHub)" <gi...@apache.org>.
mdeshmu commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1666318369
> IMO, In this case, A user should not be able to open a chart in Explore by clicking on the chart title in the dashboard.
> Note the challenge is currently we (many of the committers) don't have a good sense on what the actual desired UX was—the unit/integration tests which initially failed due to my change indicates that chart exploration was viable, albeit the issues surfaced in this issue. I'm hoping that @villebro can provide some additional context on the situation.
@villebro can you please clarify what is the desired behavior?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] john-bodley commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "john-bodley (via GitHub)" <gi...@apache.org>.
john-bodley commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1648726754
As a follow up I gather creating a copy of the dashboard (see screenshot) should also likely be forbidden, i.e., said user is stepping beyond the intent of the dashboard owner(s) who provided the RBAC to the role.
<img width="235" alt="Screenshot 2023-07-24 at 3 41 04 PM" src="https://github.com/apache/superset/assets/4567245/b0f4a0a8-173b-45e6-91ca-f4aa325fb69a">
Spelunking through the code I _think_ [this](https://github.com/apache/superset/blob/master/superset/security/manager.py#L1850-L1853) is likely one part of the logic which should change, i.e., access to the underly ing dataset should be context aware—granted only in the context of an accessible dashboard.
Sadly complicated logic doesn't bode well from a security/access perspective and thus I wonder in a future release whether we should consider reverting this feature given the complexity of how/where these controls are enforced—be that within the security manager, filters, etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] mattitoo commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "mattitoo (via GitHub)" <gi...@apache.org>.
mattitoo commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1649250339
Just to be sure about the intended behavior:
a) If the user has no permissions to the datasets, but the dashboard is visible due to RBAC, she/he should not be able to copy the dashboard via "Save as".
b) If the user has permission to the datasets, he/she should be able to make a copy via "Save as".
Is my thinking correct?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] john-bodley commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "john-bodley (via GitHub)" <gi...@apache.org>.
john-bodley commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1648665335
@betodealmeida , @mdeshmu, @michael-s-molina, @sfirke et al. I'm trying to get up to speed with the RBAC for dashboards. Per the documentation it states,
> Granting a role access to a dashboard will bypass dataset level checks. Having dashboard access implicitly grants read access to all the featured charts in the dashboard, and thereby also all the associated datasets.
is the _intended_ behavior that by adding an RBAC role than users of said role are _only_ allowed to see the charts in the context of the dashboard, i.e., should not be able to either explore it, save it (via save-as), or directly access the underlying dataset?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] mdeshmu commented on issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "mdeshmu (via GitHub)" <gi...@apache.org>.
mdeshmu commented on issue #24782:
URL: https://github.com/apache/superset/issues/24782#issuecomment-1648808324
Thank you so much @john-bodley for looking into this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] john-bodley closed issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
Posted by "john-bodley (via GitHub)" <gi...@apache.org>.
john-bodley closed issue #24782: Gamma user can clone a dashboard and all of its charts without being owner of dashboard, chart and its underlying dataset
URL: https://github.com/apache/superset/issues/24782
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org