rusackas commented on code in PR #37516:
URL: https://github.com/apache/superset/pull/37516#discussion_r3656232500
##########
superset/commands/explore/get.py:
##########
@@ -125,16 +126,17 @@ def run(self) -> Optional[dict[str, Any]]: # noqa: C901
datasource_name = datasource.name
if slc:
security_manager.raise_for_access(chart=slc)
+ elif isinstance(datasource, Query):
+ datasource.raise_for_explore_access()
Review Comment:
Same as the other CodeAnt thread on `explore/utils.py`,
`raise_for_explore_access()` calls `security_manager.raise_for_access()`
internally for Query datasources. The other two branches right here already
call `raise_for_access()` directly, so this isn't an oversight.
##########
superset/common/query_context.py:
##########
@@ -98,6 +104,19 @@ def get_payload(
"""Returns the query results with both metadata and data"""
return self._processor.get_payload(cache_query_context, force_cached)
+ def get_payload_result(
+ self,
+ cache_query_context: bool | None = False,
+ force_cached: bool = False,
+ materialize: bool = True,
+ ) -> QueryContextExecutionResult:
+ """Execute queries with timing retained in a typed sidecar."""
+ return self._processor.get_payload_result(
+ cache_query_context,
+ force_cached,
+ materialize,
+ )
Review Comment:
`get_payload_result()` mirrors `get_payload()` right above it, neither
checks access inline. Access is gated earlier, `ChartDataCommand.validate()`
calls `query_context.raise_for_access()` before `execute()`/`run()` ever
touches this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
