Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Allows PUT and DELETE only for owners of dashboard filter state #17644

Conversation

michael-s-molina
Copy link
Member

SUMMARY

This PR changes the dashboard filters state endpoint to only allow PUT and DELETE for the owners of the dashboard filter state. If someone else tries to issue these operations, a 403 is returned. The main objective of this change is to prevent other users from overriding the owner's state.

Two more tests were added to include the new rules: test_put_not_owner and test_delete_not_owner

TESTING INSTRUCTIONS

1 - Execute all tests
2 - All tests should pass

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@codecov
Copy link

codecov bot commented Dec 3, 2021

Codecov Report

Merging #17644 (8bf1066) into master (b13d953) will increase coverage by 0.21%.
The diff coverage is 98.03%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #17644      +/-   ##
==========================================
+ Coverage   68.51%   68.72%   +0.21%     
==========================================
  Files        1602     1603       +1     
  Lines       65349    65392      +43     
  Branches     6992     6992              
==========================================
+ Hits        44772    44942     +170     
+ Misses      18691    18564     -127     
  Partials     1886     1886              
Flag Coverage Δ
hive 81.69% <98.03%> (+0.30%) ⬆️
mysql 82.10% <98.03%> (+0.30%) ⬆️
postgres 82.11% <98.03%> (+0.30%) ⬆️
presto 81.99% <98.03%> (?)
python 82.60% <98.03%> (+0.45%) ⬆️
sqlite 81.80% <98.03%> (+0.30%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
superset/dashboards/filter_state/commands/get.py 86.66% <75.00%> (+36.66%) ⬆️
...uperset/dashboards/filter_state/commands/create.py 92.85% <100.00%> (+29.22%) ⬆️
...uperset/dashboards/filter_state/commands/delete.py 94.44% <100.00%> (+30.80%) ⬆️
superset/dashboards/filter_state/commands/entry.py 100.00% <100.00%> (ø)
...uperset/dashboards/filter_state/commands/update.py 95.00% <100.00%> (+31.36%) ⬆️
superset/key_value/api.py 78.31% <100.00%> (+36.84%) ⬆️
superset/key_value/commands/create.py 85.71% <100.00%> (+28.57%) ⬆️
superset/key_value/commands/delete.py 84.00% <100.00%> (+24.00%) ⬆️
superset/key_value/commands/exceptions.py 100.00% <100.00%> (ø)
superset/key_value/commands/get.py 85.71% <100.00%> (+28.57%) ⬆️
... and 24 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b13d953...8bf1066. Read the comment docs.

Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great! Two minor nits/comments/questions that I'd be curious to hear your thoughts on

superset/dashboards/filter_state/commands/create.py Outdated Show resolved Hide resolved
superset/key_value/commands/create.py Outdated Show resolved Hide resolved
Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with those non-blocking comments

@michael-s-molina michael-s-molina merged commit 2ae83fa into apache:master Dec 6, 2021
pkdotson added a commit to preset-io/superset that referenced this pull request Dec 7, 2021
@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 1.5.0 labels Mar 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/L 🚢 1.5.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants