[GitHub] [superset] john-bodley commented on pull request #24996: fix: Revert "fix: Dashboard aware RBAC dataset permission (#24789)"

["john-bodley (via GitHub)" <gi...@apache.org>]

john-bodley commented on PR #24996:
URL: https://github.com/apache/superset/pull/24996#issuecomment-1679813683

   Thanks @jfrag1 for raising this. I did wonder if the form-data was trustworthy, but had assumed (wrongfully) that it was given it came from either the query-context or visualization.
   
   In https://github.com/apache/superset/pull/24804 I refactored the `raise_for_access` method so it could be dashboard aware and thus 🤞 that’s a viable trusted route, i.e., find the caller and pass in the `dashboard`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org