You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "gdevanla (via GitHub)" <gi...@apache.org> on 2023/09/30 18:43:05 UTC
[GitHub] [superset] gdevanla opened a new issue, #25472: A user able to access chart through explore URL, without access to underlying dataset
gdevanla opened a new issue, #25472:
URL: https://github.com/apache/superset/issues/25472
A clear and concise description of what the bug is.
#### How to reproduce the bug
1. As an Admin user, create a chart on a dataset for which another non-admin user does not have access to
2. Capture the slide_id of the chart.
3. Login as a non-admin user. Notice that in the 'Charts' list page, the newly created chart is not visible since the dataset accessed by the chart is not visible to this non-admin user.
4. Use the following URL with the capture slice_id: http://localhost:8088/explore/?slice_id=<slice_id> here
5. Notice, that the chart gets rendered along with the data
### Expected results
The chart should not be rendered, since it clearly violates the permissions.
### Actual results
what actually happens.
The chart gets rendered along with the data, and user is able to save the chart.
### Environment
(please complete the following information):
- browser type and version: Chrome
- superset version: 2.1.0
- python version: 3.8x
- any feature flags active: DASHBOARD_RBAC
### Checklist
Make sure to follow these steps before submitting your issue - thank you!
- [ ] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [ ] I have reproduced the issue with at least the latest released version of superset.
- [ x] I have checked the issue tracker for the same issue and I haven't found one similar.
### Additional context
Even in the latest code base, this line here: https://github.com/apache/superset/blob/8553b06155249c3583cf0dcd22221ec06cbb833d/superset/views/utils.py#L216
does not check any other permissions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] A user able to access chart through explore URL, without access to underlying dataset [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #25472:
URL: https://github.com/apache/superset/issues/25472#issuecomment-1997870350
I'm not sure if this is still an issue in current versions of Superset (3.x). If it is, we can re-open this, or feel free to open a new issue with updated context and a reproducible case using example data. We're no longer supporting Superset 2.x or prior, and it's been a while since this thread saw any activity, so I'm closing this as stale.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] A user able to access chart through explore URL, without access to underlying dataset [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #25472: A user able to access chart through explore URL, without access to underlying dataset
URL: https://github.com/apache/superset/issues/25472
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] A user able to access chart through explore URL, without access to underlying dataset [superset]
Posted by "mdeshmu (via GitHub)" <gi...@apache.org>.
mdeshmu commented on issue #25472:
URL: https://github.com/apache/superset/issues/25472#issuecomment-1742935672
I believe this is fixed in https://github.com/apache/superset/pull/24789 but didn't make it to 2.1.1
You can ask to include it in 2.1.2 (once its discussion thread starts) or upgrade to 3.0.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org