You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by jo...@apache.org on 2024/06/26 16:43:37 UTC
(superset) 01/01: chore(security): Clean up session/commit logic
This is an automated email from the ASF dual-hosted git repository.
johnbodley pushed a commit to branch john-bodley--security-cleanup
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 769f5f054d0fdb928310039ba2b50c2f665fab3b
Author: John Bodley <45...@users.noreply.github.com>
AuthorDate: Wed Jun 26 09:43:30 2024 -0700
chore(security): Clean up session/commit logic
---
superset/security/manager.py | 22 ++++++----------------
1 file changed, 6 insertions(+), 16 deletions(-)
diff --git a/superset/security/manager.py b/superset/security/manager.py
index a67870a398..ac70cfbdcc 100644
--- a/superset/security/manager.py
+++ b/superset/security/manager.py
@@ -1017,9 +1017,9 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
== None, # noqa: E711
)
)
- self.get_session.commit()
if deleted_count := pvms.delete():
logger.info("Deleted %i faulty permissions", deleted_count)
+ self.get_session.commit()
def sync_role_definitions(self) -> None:
"""
@@ -1047,9 +1047,6 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
)
self.create_missing_perms()
-
- # commit role and view menu updates
- self.get_session.commit()
self.clean_perms()
def _get_all_pvms(self) -> list[PermissionView]:
@@ -2446,8 +2443,7 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
user_roles = [role.id for role in self.get_user_roles(g.user)]
regular_filter_roles = (
- self.get_session()
- .query(RLSFilterRoles.c.rls_filter_id)
+ self.get_session.query(RLSFilterRoles.c.rls_filter_id)
.join(RowLevelSecurityFilter)
.filter(
RowLevelSecurityFilter.filter_type == RowLevelSecurityFilterType.REGULAR
@@ -2455,8 +2451,7 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
.filter(RLSFilterRoles.c.role_id.in_(user_roles))
)
base_filter_roles = (
- self.get_session()
- .query(RLSFilterRoles.c.rls_filter_id)
+ self.get_session.query(RLSFilterRoles.c.rls_filter_id)
.join(RowLevelSecurityFilter)
.filter(
RowLevelSecurityFilter.filter_type == RowLevelSecurityFilterType.BASE
@@ -2464,13 +2459,11 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
.filter(RLSFilterRoles.c.role_id.in_(user_roles))
)
filter_tables = (
- self.get_session()
- .query(RLSFilterTables.c.rls_filter_id)
+ self.get_session.query(RLSFilterTables.c.rls_filter_id)
.filter(RLSFilterTables.c.table_id == table.id)
)
query = (
- self.get_session()
- .query(
+ self.get_session.query(
RowLevelSecurityFilter.id,
RowLevelSecurityFilter.group_key,
RowLevelSecurityFilter.clause,
@@ -2673,12 +2666,9 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
:raises SupersetSecurityException: If the current user is not an owner
"""
- # pylint: disable=import-outside-toplevel
- from superset import db
-
if self.is_admin():
return
- orig_resource = db.session.query(resource.__class__).get(resource.id)
+ orig_resource = self.get_session.query(resource.__class__).get(resource.id)
owners = orig_resource.owners if hasattr(orig_resource, "owners") else []
if g.user.is_anonymous or g.user not in owners: