Small changes

apache · Jul 28, 2023 · 7668aec · 7668aec
1 parent bcf1fc5
commit 7668aec
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 20 deletions.
diff --git a/superset/security/manager.py b/superset/security/manager.py
@@ -2067,24 +2067,22 @@ def can_access_based_on_dashboard(datasource: "BaseDatasource") -> bool:
             return True
 
         # check for datasets that are only used by filters
-        else:
-            dashboards_json = (
-                db.session.query(Dashboard.json_metadata)
-                .filter(Dashboard.id.in_(dashboard_ids))
-                .all()
-            )
-            for json_ in dashboards_json:
-                try:
-                    json_metadata = json.loads(json_.json_metadata)
-                    for filter_ in json_metadata.get("native_filter_configuration", []):
-                        filter_dataset_ids = [
-                            target.get("datasetId")
-                            for target in filter_.get("targets", [])
-                        ]
-                        if datasource.id in filter_dataset_ids:
-                            return True
-                except ValueError:
-                    pass
+        dashboards_json = (
+            db.session.query(Dashboard.json_metadata)
+            .filter(Dashboard.id.in_(dashboard_ids))
+            .all()
+        )
+        for json_ in dashboards_json:
+            try:
+                json_metadata = json.loads(json_.json_metadata)
+                for filter_ in json_metadata.get("native_filter_configuration", []):
+                    filter_dataset_ids = [
+                        target.get("datasetId") for target in filter_.get("targets", [])
+                    ]
+                    if datasource.id in filter_dataset_ids:
+                        return True
+            except ValueError:
+                pass
 
         return False
 

diff --git a/tests/integration_tests/security/guest_token_security_tests.py b/tests/integration_tests/security/guest_token_security_tests.py
@@ -237,9 +237,10 @@ def test_raise_for_dashboard_access_as_guest_no_rbac(self):
         db.session.delete(dash)
         db.session.commit()
 
-    def test_can_access_based_on_dashboard_with_filter(self):
+    def test_can_access_datasource_used_in_dashboard_filter(self):
         """
-        Test that a user can access a datasource used only by a filter in a dashboard.
+        Test that a user can access a datasource used only by a filter in a dashboard
+        they have access to.
         """
         # Create a test dataset
         test_dataset = SqlaTable(