rusackas commented on code in PR #37773: URL: https://github.com/apache/superset/pull/37773#discussion_r3997243161
########## superset/config.py: ########## @@ -2076,6 +2076,13 @@ def allowed_schemas_for_csv_upload( # pylint: disable=unused-argument FAB_API_KEY_ENABLED = False FAB_API_KEY_PREFIXES = ["sst_"] +# When False (default), the legacy FAB SSR admin password reset route +# (/superset/resetpassword) is not registered. The self-service password reset +# route (/superset/resetmypassword) is also skipped unless forced password +# changes are enabled, since that flow still needs a reachable reset form. +# Set to True to re-enable direct URL access to those views (e.g. during migration). +ENABLE_LEGACY_FAB_PASSWORD_VIEWS: bool = False Review Comment: Pushed a fix: `sync_role_definitions` now excludes `ResetPasswordView`/`ResetMyPasswordView` from role assignment whenever the flag says they should not be registered, so a permission row persisted from before this flag existed does not stick around on Admin after an upgrade. Added a test that seeds a stale row and asserts it gets excluded. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
