alexandrusoare commented on code in PR #43111:
URL: https://github.com/apache/superset/pull/43111#discussion_r3812160642
##########
superset/security/manager.py:
##########
@@ -1236,6 +1399,13 @@ def query_context_modified(query_context:
"QueryContext") -> bool:
# than accepting any payload, constrain them to the column(s) the
dashboard's
# native filter is allowed to target; other chartless paths keep prior
# behavior (see _native_filter_request_modified).
+ #
+ # SQL extras (extras.where/having) are NOT validated on chartless paths:
+ # without a stored chart there is nothing to validate against, and
+ # tightening this would break legitimate chartless flows (native-filter
+ # pre-filtering, drill-to-detail) that carry SQL extras. These paths
+ # are still protected by datasource-access checks in raise_for_access.
+ # The _sql_filters_modified check below covers chart payloads only.
Review Comment:
Yes, intentional
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
