[GitHub] [superset] michael-s-molina commented on pull request #17511: fix: Dashboard access when DASHBOARD_RBAC is disabled

[GitBox <gi...@apache.org>]

michael-s-molina commented on pull request #17511:
URL: https://github.com/apache/superset/pull/17511#issuecomment-975870169


   @villebro @amitmiran137 these tests in `dashboard/api_tests.py` are checking for specific conditions:
   
   ```
   @pytest.mark.usefixtures("load_world_bank_dashboard_with_slices")
   def test_get_draft_dashboard_datasets(self):
       """
       All users should have access to dashboards without roles
       """
       self.login(username="gamma")
       uri = "api/v1/dashboard/world_health/datasets"
       response = self.get_assert_metric(uri, "get_datasets")
       self.assertEqual(response.status_code, 200)
   
   @pytest.mark.usefixtures("create_dashboards")
   def test_get_draft_dashboard_charts(self):
       """
       All users should have access to draft dashboards without roles
       """
       self.login(username="gamma")
       dashboard = self.dashboards[0]
       uri = f"api/v1/dashboard/{dashboard.id}/charts"
       response = self.get_assert_metric(uri, "get_charts")
       assert response.status_code == 200
   ```
   
   I added the following line giving access to any user if the dashboard is not published and has no roles. 
   
   https://github.com/apache/superset/blob/893595ec1a5e9d2d7b27ac7a7c7cf053905cf124/superset/security/manager.py#L1189
   
   Can you confirm that this is the expected behavior?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org