rusackas commented on code in PR #37773:
URL: https://github.com/apache/superset/pull/37773#discussion_r3997242643
##########
superset/security/manager.py:
##########
@@ -4329,6 +4329,35 @@ def is_admin(self) -> bool:
# temporal change to remove the roles view from the security menu,
# after migrating all views to frontend, we will set
FAB_ADD_SECURITY_VIEWS = False
+ def _skip_legacy_fab_password_view_registration(self) -> Callable[...,
Any]:
+ original_add_view_no_menu = self.appbuilder.add_view_no_menu
Review Comment:
Added a docstring to `_skip_legacy_fab_password_view_registration` covering
what it patches and what the returned callable is for.
##########
superset/config.py:
##########
@@ -2094,6 +2094,13 @@ def allowed_schemas_for_csv_upload( # pylint:
disable=unused-argument
FAB_API_KEY_ENABLED = False
FAB_API_KEY_PREFIXES = ["sst_"]
+# When False (default), the legacy FAB SSR admin password reset route
+# (/superset/resetpassword) is not registered. The self-service password reset
+# route (/superset/resetmypassword) is also skipped unless forced password
+# changes are enabled, since that flow still needs a reachable reset form.
+# Set to True to re-enable direct URL access to those views (e.g. during
migration).
+ENABLE_LEGACY_FAB_PASSWORD_VIEWS: bool = False
Review Comment:
Added an UPDATING.md entry for this, so anyone still linking to
`/superset/resetpassword` or `/superset/resetmypassword` knows to set
`ENABLE_LEGACY_FAB_PASSWORD_VIEWS = True` before upgrading.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
