PERMISSIONS.DASHBOARD_MANAGE bypass query parser

merico-dev · Sep 13, 2023 · b12bca3 · b12bca3
1 parent 5e71b1f
commit b12bca3
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/api/src/services/query.service.ts b/api/src/services/query.service.ts
@@ -17,6 +17,7 @@ import { has } from 'lodash';
 import { translate } from '../utils/i18n';
 import SqlSnippet from '../models/sql_snippet';
 import { QUERY_PARSING_ENABLED } from '../utils/constants';
+import { PERMISSIONS } from './role.service';
 
 type Query = {
   id: string;
@@ -284,7 +285,7 @@ export class QueryService {
     locale: string,
     auth?: Account | ApiKey,
   ): Promise<{ parsedType: string; parsedKey: string; parsedQuery: string }> {
-    if (!QUERY_PARSING_ENABLED) {
+    if (!QUERY_PARSING_ENABLED || auth?.permissions.includes(PERMISSIONS.DASHBOARD_MANAGE)) {
       return { parsedType: type, parsedKey: key, parsedQuery: query };
     }
     const dashboardContent = await dashboardDataSource