Fix SQL Lab schema permission checks #9756
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bkyryliuk
force-pushed
the
bogdan/fix_schema_perm
branch
from
04c1cbd to
a865be6
Compare
Codecov Report
@@ Coverage Diff @@
## master #9756 +/- ##
===========================================
- Coverage 70.49% 53.78% -16.72%
===========================================
Files 402 352 -50
Lines 12564 11232 -1332
Branches 3112 2782 -330
===========================================
- Hits 8857 6041 -2816
- Misses 3593 5011 +1418
- Partials 114 180 +66
Continue to review full report at Codecov.
|
bkyryliuk
force-pushed
the
bogdan/fix_schema_perm
branch
3 times, most recently
from
ae926df to
9d947a0
Compare
mistercrunch
added
.security
!deprecated-label:bug
bkyryliuk
force-pushed
the
bogdan/fix_schema_perm
branch
from
9d947a0 to
6c4d8b2
Compare
john-bodley
reviewed
May 6, 2020
superset/security/manager.py
Outdated
| query = sql_parse.ParsedQuery(sql) | ||
|
|
||
| return { | ||
| table | ||
| for table in query.tables | ||
| if not self.can_access_datasource(database, table, schema) | ||
| if not self.can_access_datasource(database, table, table.schema or schema) |
There was a problem hiding this comment.
I wonder if this line should be reverted, i.e., the schema is the fallback schema per the docstring and can_access_datasource should be changed to be,
schema_perm = self.get_schema_perm(database, table.schema or schema)
There was a problem hiding this comment.
@john-bodley good point, that is more appropriate place. updated the PR.
bkyryliuk
force-pushed
the
bogdan/fix_schema_perm
branch
4 times, most recently
from
056d694 to
18d2967
Compare
bkyryliuk
force-pushed
the
bogdan/fix_schema_perm
branch
from
18d2967 to
e6290a6
Compare
john-bodley
approved these changes
May 6, 2020
|
@john-bodley could you merge it, I am still waiting on getting the rights |
mistercrunch
added
🏷️ bot
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CATEGORY
Choose one
SUMMARY
Fixes #9754
Schema permission checks on the table in the sqllab
Also this change adds the unit tests to prevent future regressions.
TEST PLAN
[x] unit tests
[x] local test
[ ] dropbox staging - TBD
ADDITIONAL INFORMATION
REVIEWERS
@john-bodley