You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "namemlo (via GitHub)" <gi...@apache.org> on 2025/03/25 01:45:51 UTC
[PR] Simplify date filter with new date calendar filter [superset]
namemlo opened a new pull request, #32834:
URL: https://github.com/apache/superset/pull/32834
Add a new endpoint to fetch annotations for a given layer.
* Modify `superset/annotation_layers/api.py` to add a new endpoint `/annotation_layers/<int:layer_id>/annotations` to fetch all annotations for a given layer.
* Modify `superset/annotation_layers/annotations/api.py` to add a new endpoint `/annotation_layers/<int:layer_id>/annotations` to fetch all annotations for a given layer.
* Add `AnnotationGetSchema` to `superset/annotation_layers/annotations/schemas.py` to define the schema for fetching annotations.
* Add `AnnotationGetSchema` to `superset/annotation_layers/schemas.py` to define the schema for fetching annotations.
---
For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/apache/superset?shareId=XXXX-XXXX-XXXX-XXXX).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Simplify date filter with new date calendar filter [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #32834:
URL: https://github.com/apache/superset/pull/32834#issuecomment-4255950254
Closing due to inactivity, but feel free to reopen if/when the branch is brought up to speed!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Simplify date filter with new date calendar filter [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on code in PR #32834:
URL: https://github.com/apache/superset/pull/32834#discussion_r2027300053
##########
docker/pythonpath_dev/superset_config.py:
##########
@@ -41,6 +41,7 @@
EXAMPLES_HOST = os.getenv("EXAMPLES_HOST")
EXAMPLES_PORT = os.getenv("EXAMPLES_PORT")
EXAMPLES_DB = os.getenv("EXAMPLES_DB")
+SECRET_KEY = "9eB7MN3J8v1zy/5Pkoqm+GPMXxMuh9RReCQ0RT83uUsvnsoJ/swJwv0f"
Review Comment:
@namemlo just to ping your inbox a bit more loudly ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Simplify date filter with new date calendar filter [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed pull request #32834: Simplify date filter with new date calendar filter
URL: https://github.com/apache/superset/pull/32834
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Simplify date filter with new date calendar filter [superset]
Posted by "korbit-ai[bot] (via GitHub)" <gi...@apache.org>.
korbit-ai[bot] commented on code in PR #32834:
URL: https://github.com/apache/superset/pull/32834#discussion_r2011159161
##########
superset/annotation_layers/api.py:
##########
@@ -352,3 +352,67 @@ def bulk_delete(self, **kwargs: Any) -> Response:
return self.response_422(message=str(ex))
except AnnotationLayerDeleteFailedError as ex:
return self.response_422(message=str(ex))
+
+ @expose("/<int:layer_id>/annotations", methods=("GET",))
+ @protect()
+ @safe
+ @permission_name("get")
+ def get_annotations(self, layer_id: int) -> Response:
+ """Get all annotations for a given layer.
+ ---
+ get:
+ summary: Get all annotations for a given layer
+ parameters:
+ - in: path
+ schema:
+ type: integer
+ name: layer_id
+ description: The annotation layer id
+ responses:
+ 200:
+ description: Annotations fetched
+ content:
+ application/json:
+ schema:
+ type: array
+ items:
+ type: object
+ properties:
+ id:
+ type: integer
+ start_dttm:
+ type: string
+ format: date-time
+ end_dttm:
+ type: string
+ format: date-time
+ short_descr:
+ type: string
+ long_descr:
+ type: string
+ json_metadata:
+ type: string
+ 404:
+ $ref: '#/components/responses/404'
+ 500:
+ $ref: '#/components/responses/500'
+ """
+ annotations = (
+ self.appbuilder.get_session.query(Annotation)
+ .filter(Annotation.layer_id == layer_id)
+ .all()
+ )
Review Comment:
### Missing Layer Access Authorization Check <sub></sub>
<details>
<summary>Tell me more</summary>
###### What is the issue?
The get_annotations endpoint retrieves annotations without verifying if the requesting user has permission to access the specific layer_id.
###### Why this matters
This could allow unauthorized users to access annotation data from any layer by simply knowing or guessing layer IDs, potentially exposing sensitive information.
###### Suggested change ∙ *Feature Preview*
Add authorization check before querying annotations:
```python
layer = self.appbuilder.get_session.query(AnnotationLayer).get(layer_id)
if not layer or not security_manager.can_access('can_read', layer):
return self.response_404()
```
###### Provide feedback to improve future suggestions
[](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/f740d6ff-5907-4546-864e-0af37bcbf125/upvote) [](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/f740d6ff-5907-4546-864e-0af37bcbf125?what_not_true=true) [](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/f740d6ff-5907-4546-864e-0af37bcbf125?what_out_of_scope=true) [](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/f740d6ff-5907-4546-864e-0af37bcbf125?what_not_in_standard=true) [](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/f740d6ff-5907-4546-864e-0af37bcbf125)
</details>
<sub>
💬 Looking for more details? Reply to this comment to chat with Korbit.
</sub>
<!--- korbi internal id:68d910db-6124-4326-bdd9-9be7dc0b0101 -->
[](68d910db-6124-4326-bdd9-9be7dc0b0101)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Simplify date filter with new date calendar filter [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on code in PR #32834:
URL: https://github.com/apache/superset/pull/32834#discussion_r2027298184
##########
docker/pythonpath_dev/superset_config.py:
##########
@@ -41,6 +41,7 @@
EXAMPLES_HOST = os.getenv("EXAMPLES_HOST")
EXAMPLES_PORT = os.getenv("EXAMPLES_PORT")
EXAMPLES_DB = os.getenv("EXAMPLES_DB")
+SECRET_KEY = "9eB7MN3J8v1zy/5Pkoqm+GPMXxMuh9RReCQ0RT83uUsvnsoJ/swJwv0f"
Review Comment:
If that's real, you.... might wanna rotate the key :D
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Simplify date filter with new date calendar filter [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #32834:
URL: https://github.com/apache/superset/pull/32834#issuecomment-3643672446
This PR hasn't been updated in a long time and is in need of a rebase. We'll mark it as draft, but please set it as 'ready for review' when it's been brought up to speed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org