aminghadersohi commented on code in PR #44021:
URL: https://github.com/apache/superset/pull/44021#discussion_r4002380192
##########
superset/versioning/api_helpers.py:
##########
@@ -283,18 +298,26 @@ def resolve_endpoint_path_entity(
if entity is None:
raise PathEntityResponseError(api.response_404())
- # Direct ``[…]`` would leak the unknown model name into a generic 500
- # via the unhandled ``KeyError`` exception text. The three resource
- # families wired today cover every key; a future entity added to the
- # versioning surface without updating this dispatch table should fail
- # closed (the test suite picks it up) rather than silently disclose.
- kwarg = _RAISE_FOR_ACCESS_KWARG.get(model_cls.__name__)
- if kwarg is None:
- raise LookupError(
- f"No raise_for_access kwarg registered for {model_cls.__name__!r}"
- )
+ # M10 / SECURITY.md's guest row: an embedded guest's capability is
+ # reading the dashboards its token authorizes — never their change
+ # logs (author identities, field-level diffs). Denied explicitly
+ # BEFORE the editorship check: ``is_editor`` maps a guest's ROLE
+ # subjects into the editor set, so a role subject granted editorship
+ # would otherwise admit every guest holding that role.
+ if security_manager.is_guest_user():
Review Comment:
Worth grading against master before acting on the enumeration point: the
404-then-403 ordering is inherited, not introduced — on master this path
returned 200 with the full change log to the same principal. Real, but strictly
narrower than what it replaced.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
