mikebridge commented on PR #44013: URL: https://github.com/apache/superset/pull/44013#issuecomment-5589167602
@aminghadersohi — ready for review when you have a moment. Small authz fix: version restore was withheld from externally managed entities only in the browser, so an otherwise-authorized editor could restore one via a direct API call (and have it overwritten on the next external sync). `BaseRestoreVersionCommand.validate()` now refuses managed-externally entities with 403 after the editorship check; soft-delete recovery is deliberately left available. Parametrized unit tests over all three concrete commands + a real-chart integration test (403, no mutation). A cross-model pass confirmed the gate is complete; the same gap on the ordinary PUT/update commands is tracked separately as sc-120011. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
