Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SQL editor should allow execution of write queries, if you have permission #982

Open
simonw opened this issue Sep 30, 2020 · 2 comments
Open
Labels

Comments

@simonw
Copy link
Owner

simonw commented Sep 30, 2020

The datasette-write plugin provides this at the moment https://github.com/simonw/datasette-write - but it feels like it should be a built-in capability, protected by a default permission.

UI concept: if you have write permission then the existing SQL editor gets an "execute write" checkbox underneath it.

JavaScript can spot if you appear to be trying to execute an UPDATE or INSERT or DELETE query and check that checkbox for you.

If you link to a query page with a non-SELECT then that query will be displayed in the box ready for you to POST submit it. The page will also then get "cannot be embedded" headers to protect against clickjacking.

@simonw simonw added the feature label Sep 30, 2020
@simonw
Copy link
Owner Author

simonw commented Sep 30, 2020

The form needs to switch from GET to POST if the query is a write query. JavaScript can handle this based on the checkbox - if a user does not have JavaScript submitting the form will cause the form action to be changed to POST and the form to be redisplayed.

@simonw
Copy link
Owner Author

simonw commented Sep 30, 2020

This is a little related to the error display issue #619 in that both will require some reworking of how the code is structured.

@simonw simonw added this to the Datasette 0.52 milestone Nov 1, 2020
@simonw simonw modified the milestones: Datasette 0.52, Datasette Next Nov 28, 2020
@simonw simonw removed this from the Datasette Next milestone Jan 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant