Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: prevent guest users from changing columns #29530

Merged
merged 4 commits into from
Jul 10, 2024
Merged

fix: prevent guest users from changing columns #29530

merged 4 commits into from
Jul 10, 2024

Conversation

betodealmeida
Copy link
Member

SUMMARY

An extension to #26749, preventing guest users from modifying adhoc columns when requesting charts.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

Added unit tests.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@dosubot dosubot bot added the authentication:access-control Rlated to access control label Jul 9, 2024
Vitor-Avila
Vitor-Avila reviewed Jul 10, 2024
View reviewed changes
superset/security/manager.py Outdated
@@ -145,9 +145,9 @@ def __init__(self, **kwargs: Any) -> None:
RoleModelView.related_views = []


def freeze_metric(metric: Metric) -> str:
def freeze_value(metric: Metric) -> str:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Super nitpicky, but maybe we want to also change the parameter name from metric to something generic as well (such as value)?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

D'oh, good point! I missed that!

Vitor-Avila
Vitor-Avila reviewed Jul 10, 2024
View reviewed changes
superset/security/manager.py Outdated
for metric in query.metrics or []
}
# compare columns and metrics in form_data with stored values
for key in ["metrics", "columns"]:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think some viz types might have the columns listed as groupby in the form_data:

image

Copy link
Contributor

@Vitor-Avila Vitor-Avila Jul 10, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested via the browser (just inspecting the request the frontend sends to the /api/v1/chart/data endpoint), but it's possible this structure changes until it gets to this point, so I could be wrong.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do see it listed as columns in the queries, tho:

image

Vitor-Avila
Vitor-Avila reviewed Jul 10, 2024
View reviewed changes
Copy link
Contributor

@Vitor-Avila Vitor-Avila left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some comments -- let me know your thoughts

@betodealmeida
Copy link
Member Author

Good point! I added groupby, as far as I can see that should be it.

Vitor-Avila
Vitor-Avila approved these changes Jul 10, 2024
View reviewed changes
Copy link
Contributor

@Vitor-Avila Vitor-Avila left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the quick fixes! 🙌 LGTM!

Not a blocking comment, but I would just also add a test with a payload containing groupby as opposed (or maybe both) to columns.

@rusackas
Copy link
Member

Question from the PR review session: If the last PR that this builds on caused a lot of Issues for embedded users, will there be any additional fallout from this PR, and will we be available to address these concerns?

@betodealmeida betodealmeida merged commit 67df4e3 into master Jul 10, 2024
33 checks passed
@rusackas rusackas deleted the prevent-column-modifications branch July 10, 2024 18:16
@rusackas
Copy link
Member

Not sure if/how this intersects with this issue.

@betodealmeida
Copy link
Member Author

@rusackas I'm not expecting as much trouble as the first PR, since this one just extends the first one for a few more attributes.

eschutho pushed a commit that referenced this pull request Jul 24, 2024
@betodealmeida @eschutho
fix: prevent guest users from changing columns (#29530)
4c02701
@github-actions github-actions bot added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 4.1.0 labels Nov 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Vitor-Avila Vitor-Avila Vitor-Avila approved these changes

@dpgaspar dpgaspar Awaiting requested review from dpgaspar

Assignees
No one assigned
Labels
authentication:access-control Rlated to access control 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/L 🚢 4.1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@betodealmeida @rusackas @Vitor-Avila