mikebridge commented on code in PR #44093:
URL: https://github.com/apache/superset/pull/44093#discussion_r4007304548
##########
superset/security/manager.py:
##########
@@ -4967,7 +4980,9 @@ def member_datasource_accessible() -> bool:
return True
return False
- if not member_slices or member_datasource_accessible():
+ if dashboard.published and (
Review Comment:
Accepted, disclosed in 9c4de6007c — the release note now names runtime
breakage explicitly: an already-scheduled report against an unpublished
no-viewers dashboard whose execute-as principal is a datasource-entitled
non-editor fails on its next run, with the operator audit + remediation options
(publish, add the principal to viewers, or re-own the schedule). The tighten
itself stands: execution reading the dashboard is the same exposure the gate
closes.
##########
superset/security/manager.py:
##########
@@ -4967,7 +4980,9 @@ def member_datasource_accessible() -> bool:
return True
return False
- if not member_slices or member_datasource_accessible():
+ if dashboard.published and (
+ not member_slices or member_datasource_accessible()
Review Comment:
Confirmed by design and left open deliberately: `published` implies broad
intra-instance visibility (any authenticated user), and a published
markdown-only dashboard carrying readable content is exactly that contract —
the pre-existing comment marks it intentional and this PR narrows the fallback
to published-only precisely so this admit is bounded by the publish decision.
No change.
##########
UPDATING.md:
##########
@@ -42,6 +42,10 @@ Resample projections remain capped by `MAX_RESAMPLE_ROWS`
(default
year, …) that previously skipped the check because they have no fixed
`Timedelta`.
+### Dashboard read fallback requires a published dashboard
+
+The object-read gate's datasource-based fallback — including the admit for
dashboards with no charts — now applies to **published** dashboards only,
matching the list filter's fallback, which was already published-only.
Previously an *unpublished* dashboard with an empty viewers list was readable
by any authenticated user who could access one member datasource (or by every
authenticated user, when it had no charts — including markdown-only
dashboards), even though it appeared in no default list; and removing the last
viewer subject from a dashboard silently widened access, because the viewer
branch is published-gated while the fallback was not. Owners (folded into
editors by the subjects model), editors — including resolver-granted editors —
and admins are unaffected: they are admitted before the fallback regardless of
published state. Everything consuming the gate inherits the tightening; most
visibly, a datasource-entitled non-editor can no longer create or validate a re
port schedule against an unpublished no-viewers dashboard.
Review Comment:
Fixed in 9c4de6007c — the parity claim is now scoped to the datasource
branch only, and the note states the list filter still never yields chart-less
dashboards to ordinary users (the deliberate asymmetry narrows but persists).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
