rusackas commented on PR #42297:
URL: https://github.com/apache/superset/pull/42297#issuecomment-5108532502
@aminghadersohi one thing before this merges:
`_validate_requested_api_key_scopes` takes `user` as a param, but the actual
check (`superset/security/manager.py` around line 4863,
`self.can_access(f"can_{method}", class_permission_name)`) checks `g.user`, not
that argument. It happens to line up today since the only caller (FAB's
`ApiKeyApi`) passes `sm.current_user`, but the whole point of the function is
validating the passed-in user. Bito flagged the same line, filtered from
actually posting. Worth swapping to `self._has_view_access(user,
f"can_{method}", class_permission_name)` so it checks the argument, not
whoever's logged in.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
