[GitHub] [superset] dpgaspar commented on a diff in pull request #21302: fix: disallow users from viewing other user's profile on config

[GitBox <gi...@apache.org>]

dpgaspar commented on code in PR #21302:
URL: https://github.com/apache/superset/pull/21302#discussion_r961627602


##########
superset/config.py:
##########
@@ -1335,6 +1335,7 @@ def EMAIL_HEADER_MUTATOR(  # pylint: disable=invalid-name,unused-argument
 MENU_HIDE_USER_INFO = False
 
 # Set to False to only allow viewing own recent activity
+# or to disallow users from viewing other users profile page

Review Comment:
   Yes, on the backend change, the call to `get_user_activity_access_error` will assert if `ENABLE_BROAD_ACTIVITY_ACCESS` is `True` or not, if it's `False` and the user_id is not equal to the current user, the response will be 403 with an error msg. Following same pattern already in-place on other endpoint on `/superset`.
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org