From 6475ce86a61afd4b943b41e14747e4a84b71a567 Mon Sep 17 00:00:00 2001 From: Cedric Gampert Date: Fri, 14 May 2021 17:05:50 +0200 Subject: [PATCH] fix: do not render favorite favStars and filters for anonymous user (#14120) * fix: do not render favorite favStar and filter for anonymous user * fix: prevent anonymous user to trigger the favstar view route * fix: lint over previous commit * fix: linter follow-up --- .../explore/components/ExploreChartHeader.jsx | 16 +++-- .../explore/components/ExploreChartPanel.jsx | 1 + .../components/ExploreViewContainer.jsx | 1 + .../src/views/CRUD/chart/ChartList.tsx | 72 +++++++++++-------- .../views/CRUD/dashboard/DashboardList.tsx | 72 +++++++++++-------- superset/views/core.py | 2 + 6 files changed, 97 insertions(+), 67 deletions(-) diff --git a/superset-frontend/src/explore/components/ExploreChartHeader.jsx b/superset-frontend/src/explore/components/ExploreChartHeader.jsx index ca8842b9645b..fdcf7d275569 100644 --- a/superset-frontend/src/explore/components/ExploreChartHeader.jsx +++ b/superset-frontend/src/explore/components/ExploreChartHeader.jsx @@ -148,13 +148,15 @@ export class ExploreChartHeader extends React.PureComponent { {this.props.slice && ( - + {this.props.userId && ( + + )} { form_data={props.form_data} timeout={props.timeout} chart={props.chart} + userId={props.userId} /> ); diff --git a/superset-frontend/src/explore/components/ExploreViewContainer.jsx b/superset-frontend/src/explore/components/ExploreViewContainer.jsx index b1dee2e3710b..7444f767261e 100644 --- a/superset-frontend/src/explore/components/ExploreViewContainer.jsx +++ b/superset-frontend/src/explore/components/ExploreViewContainer.jsx @@ -592,6 +592,7 @@ function mapStateToProps(state) { timeout: explore.common.conf.SUPERSET_WEBSERVER_TIMEOUT, ownState: dataMask[form_data.slice_id]?.ownState, impressionId, + userId: explore.user_id, }; } diff --git a/superset-frontend/src/views/CRUD/chart/ChartList.tsx b/superset-frontend/src/views/CRUD/chart/ChartList.tsx index 64e4cc5e334f..e2ee33d5cca6 100644 --- a/superset-frontend/src/views/CRUD/chart/ChartList.tsx +++ b/superset-frontend/src/views/CRUD/chart/ChartList.tsx @@ -42,6 +42,7 @@ import SubMenu, { SubMenuProps } from 'src/components/Menu/SubMenu'; import FaveStar from 'src/components/FaveStar'; import ListView, { ListViewProps, + Filter, Filters, SelectOption, FilterOperator, @@ -195,23 +196,27 @@ function ChartList(props: ChartListProps) { const columns = useMemo( () => [ - { - Cell: ({ - row: { - original: { id }, - }, - }: any) => ( - - ), - Header: '', - id: 'id', - disableSortBy: true, - size: 'xs', - }, + ...(props.user.userId + ? [ + { + Cell: ({ + row: { + original: { id }, + }, + }: any) => ( + + ), + Header: '', + id: 'id', + disableSortBy: true, + size: 'xs', + }, + ] + : []), { Cell: ({ row: { @@ -377,9 +382,27 @@ function ChartList(props: ChartListProps) { hidden: !canEdit && !canDelete, }, ], - [canEdit, canDelete, canExport, favoriteStatus], + [ + canEdit, + canDelete, + canExport, + ...(props.user.userId ? [favoriteStatus] : []), + ], ); + const favoritesFilter: Filter = { + Header: t('Favorite'), + id: 'id', + urlDisplay: 'favorite', + input: 'select', + operator: FilterOperator.chartIsFav, + unfilteredLabel: t('Any'), + selects: [ + { label: t('Yes'), value: true }, + { label: t('No'), value: false }, + ], + }; + const filters: Filters = [ { Header: t('Owner'), @@ -465,18 +488,7 @@ function ChartList(props: ChartListProps) { ), paginate: false, }, - { - Header: t('Favorite'), - id: 'id', - urlDisplay: 'favorite', - input: 'select', - operator: FilterOperator.chartIsFav, - unfilteredLabel: t('Any'), - selects: [ - { label: t('Yes'), value: true }, - { label: t('No'), value: false }, - ], - }, + ...(props.user.userId ? [favoritesFilter] : []), { Header: t('Search'), id: 'slice_name', diff --git a/superset-frontend/src/views/CRUD/dashboard/DashboardList.tsx b/superset-frontend/src/views/CRUD/dashboard/DashboardList.tsx index 65fb349d9b65..9831c2640590 100644 --- a/superset-frontend/src/views/CRUD/dashboard/DashboardList.tsx +++ b/superset-frontend/src/views/CRUD/dashboard/DashboardList.tsx @@ -32,6 +32,7 @@ import ConfirmStatusChange from 'src/components/ConfirmStatusChange'; import SubMenu, { SubMenuProps } from 'src/components/Menu/SubMenu'; import ListView, { ListViewProps, + Filter, Filters, FilterOperator, } from 'src/components/ListView'; @@ -189,23 +190,27 @@ function DashboardList(props: DashboardListProps) { const columns = useMemo( () => [ - { - Cell: ({ - row: { - original: { id }, - }, - }: any) => ( - - ), - Header: '', - id: 'id', - disableSortBy: true, - size: 'xs', - }, + ...(props.user.userId + ? [ + { + Cell: ({ + row: { + original: { id }, + }, + }: any) => ( + + ), + Header: '', + id: 'id', + disableSortBy: true, + size: 'xs', + }, + ] + : []), { Cell: ({ row: { @@ -357,9 +362,27 @@ function DashboardList(props: DashboardListProps) { disableSortBy: true, }, ], - [canEdit, canDelete, canExport, favoriteStatus], + [ + canEdit, + canDelete, + canExport, + ...(props.user.userId ? [favoriteStatus] : []), + ], ); + const favoritesFilter: Filter = { + Header: t('Favorite'), + id: 'id', + urlDisplay: 'favorite', + input: 'select', + operator: FilterOperator.dashboardIsFav, + unfilteredLabel: t('Any'), + selects: [ + { label: t('Yes'), value: true }, + { label: t('No'), value: false }, + ], + }; + const filters: Filters = [ { Header: t('Owner'), @@ -414,18 +437,7 @@ function DashboardList(props: DashboardListProps) { { label: t('Draft'), value: false }, ], }, - { - Header: t('Favorite'), - id: 'id', - urlDisplay: 'favorite', - input: 'select', - operator: FilterOperator.dashboardIsFav, - unfilteredLabel: t('Any'), - selects: [ - { label: t('Yes'), value: true }, - { label: t('No'), value: false }, - ], - }, + ...(props.user.userId ? [favoritesFilter] : []), { Header: t('Search'), id: 'dashboard_title', diff --git a/superset/views/core.py b/superset/views/core.py index 52f3984591b4..0cd26449b3c7 100755 --- a/superset/views/core.py +++ b/superset/views/core.py @@ -1747,6 +1747,8 @@ def favstar( # pylint: disable=no-self-use self, class_name: str, obj_id: int, action: str ) -> FlaskResponse: """Toggle favorite stars on Slices and Dashboard""" + if not g.user.get_id(): + return json_error_response("ERROR: Favstar toggling denied", status=403) session = db.session() count = 0 favs = (