-
Notifications
You must be signed in to change notification settings - Fork 14k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: remove update_charts_owners
#25843
Conversation
@betodealmeida this logic was added in #9484 and thus maybe there's merit in connecting with @dpgaspar with regards to what the correct logic should be. Per the following screenshot it seems like one can add charts, so is the correct logic that if you add a chart you don't own then you don't become an owner of the underlying chart? |
Related PR: #21720 |
775c7f6
to
a52b0e7
Compare
He said "don't recall but it seems it was a fix for a regression, I think superset as always "worked" like that, maybe because when selecting charts for a dashboard you could only choose charts you owned".
Right, I think the old behavior doesn't apply anymore; users can now add charts that they don't own. I can't imagine a valid reason for allowing users to add themselves as owners of arbitrary charts. |
a52b0e7
to
29845f7
Compare
* fix(sqllab): reinstate "Force trino client async execution" (apache#25680) * fix: remove unnecessary redirect (apache#25679) (cherry picked from commit da42bf2) * fix(chore): dashboard requests to database equal the number of slices it has (apache#24709) (cherry picked from commit 75a7431) * fix: bump to FAB 4.3.9 remove CSP exception (apache#25712) (cherry picked from commit 8fb0c8d) * fix(horizontal filter label): show full tooltip with ellipsis (apache#25732) (cherry picked from commit e4173d9) * fix: Revert "fix(Charts): Set max row limit + removed the option to use an empty row limit value" (apache#25753) (cherry picked from commit e2fe967) * fix: dataset update uniqueness (apache#25756) (cherry picked from commit c7f8d11) * fix(sqllab): slow pop datasource query (apache#25741) (cherry picked from commit 2a2bc82) * fix: allow for backward compatible errors (apache#25640) * fix: DB-specific quoting in Jinja macro (apache#25779) (cherry picked from commit 5659c87) * fix: Revert "fix: Apply normalization to all dttm columns (apache#25147)" (apache#25801) * fix: Resolve issue apache#24195 (apache#25804) (cherry picked from commit 8737a8a) * fix(SQL field in edit dataset modal): display full sql query (apache#25768) (cherry picked from commit 1eba712) * fix(sqllab): infinite fetching status after results are landed (apache#25814) (cherry picked from commit 3f28eeb) * fix: Fires onChange when clearing all values of single select (apache#25853) (cherry picked from commit 8061d5c) * fix: the temporal x-axis results in a none time_range. (apache#25429) Co-authored-by: Elizabeth Thompson <[email protected]> (cherry picked from commit ae619b1) * fix(table chart): Show Cell Bars correctly apache#25625 (apache#25707) (cherry picked from commit 916f7bc) * fix: remove `update_charts_owners` (apache#25843) * fix(charts): Time grain is None when dataset uses Jinja (apache#25842) (cherry picked from commit 7536dd1) * fix: Saving Mixed Chart with dashboard filter applied breaks adhoc_filter_b (apache#25877) (cherry picked from commit 268c1dc) * fix: database version field (apache#25898) (cherry picked from commit 06ffcd2) * fix: trino cursor (apache#25897) (cherry picked from commit cdb18e0) * chore: Updates CHANGELOG.md for 3.0.2 * fix(trino): allow impersonate_user flag to be imported (apache#25872) Co-authored-by: John Bodley <[email protected]> (cherry picked from commit 458be8c) * fix(table): Double percenting ad-hoc percentage metrics (apache#25857) (cherry picked from commit 784a478) * fix(sqllab): invalid sanitization on comparison symbol (apache#25903) (cherry picked from commit 581d3c7) * fix: update flask-caching to avoid breaking redis cache, solves apache#25339 (apache#25947) Co-authored-by: Ville Brofeldt <[email protected]> * fix: always denorm column value before querying values (apache#25919) * chore(colors): Updating Airbnb brand colors (apache#23619) (cherry picked from commit 6d8424c) * fix: naming denomalized to denormalized in helpers.py (apache#25973) (cherry picked from commit 5def416) * fix(helm): Restart all related deployments when bootstrap script changed (apache#25703) * fix(rls): Update text from tables to datasets in RLS modal (apache#25997) (cherry picked from commit 210f1f8) * fix: Make Select component fire onChange listener when a selection is pasted in (apache#25993) (cherry picked from commit 5fccf67) * fix(explore): redandant force param (apache#25985) (cherry picked from commit e7a1876) * chore: Optimize fetching samples logic (apache#25995) (cherry picked from commit 326ac4a) * fix(native filters): rendering performance improvement by reduce overrendering (apache#25901) (cherry picked from commit e1d73d5) * fix: update FAB to 4.3.10, Azure user info fix (apache#26037) (cherry picked from commit 628cd34) * chore: Updates CHANGELOG.md for 3.0.2 (rc2) --------- Co-authored-by: Rob Moore <[email protected]> Co-authored-by: Igor Khrol <[email protected]> Co-authored-by: Stepan <[email protected]> Co-authored-by: Daniel Vaz Gaspar <[email protected]> Co-authored-by: Ross Mabbett <[email protected]> Co-authored-by: Geido <[email protected]> Co-authored-by: Beto Dealmeida <[email protected]> Co-authored-by: JUST.in DO IT <[email protected]> Co-authored-by: Elizabeth Thompson <[email protected]> Co-authored-by: John Bodley <[email protected]> Co-authored-by: Michael S. Molina <[email protected]> Co-authored-by: mapledan <[email protected]> Co-authored-by: Arko <[email protected]> Co-authored-by: Antonio Rivero <[email protected]> Co-authored-by: Kamil Gabryjelski <[email protected]> Co-authored-by: Michael S. Molina <[email protected]> Co-authored-by: FGrobelny <[email protected]> Co-authored-by: Giacomo Barone <[email protected]> Co-authored-by: Ville Brofeldt <[email protected]> Co-authored-by: Hugh A. Miles II <[email protected]> Co-authored-by: josedev-union <[email protected]> Co-authored-by: yousoph <[email protected]> Co-authored-by: Jack Fragassi <[email protected]>
SUMMARY
Currently, when a user adds a chart they don't own to a dashboard they own, they are added as owners of the chart. This behavior doesn't make sense, and allows for malicious behavior — users can modify or delete any chart this way.
This PR removes that logic.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A
TESTING INSTRUCTIONS
Create a chart as the admin user. Now login as the gamma user, and add that chart to a new dashboard. The gamma user should be able to add the chart, and they should not be added as an owner of the chart.
ADDITIONAL INFORMATION