sadpandajoe commented on code in PR #43536:
URL: https://github.com/apache/superset/pull/43536#discussion_r3867125999
##########
superset/views/user_info.py:
##########
@@ -24,11 +24,21 @@
class UserInfoView(BaseSupersetView):
+ """SPA shell for the signed-in user's own profile page.
+
+ Uses ``can_userinfo on UserInfo`` rather than ``can_read on user`` /
+ ``User``. The latter is Admin-only (``ADMIN_ONLY_VIEW_MENUS``), so
+ Alpha/Gamma were redirected to ``/superset/welcome/`` when opening
+ Settings → Info even though the menu link is shown to every
+ authenticated user. ``can_userinfo`` is already in
+ ``ACCESSIBLE_PERMS``, so stock Gamma and Alpha receive it on role sync.
+ """
+
route_base = "/"
- class_permission_name = "user"
+ class_permission_name = "UserInfo"
Review Comment:
Agreed—custom roles retain the old permission during role sync, while this
endpoint now requires a different permission/view pair, so affected users lose
Settings → Info after an upgrade. Could this include a security-converge
migration or compatibility check for roles holding the legacy PVM?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
