fix: disallow users from viewing other user's profile on config #21302

dpgaspar · 2022-09-01T19:56:14Z

SUMMARY

Allowing users to access each others profiles is not ideal and can give unwanted access to lightly sensitive (private) data, that option is not ideal to every company, but can be perfectly fine for others.

ENABLE_BROAD_ACTIVITY_ACCESS is a config option that is already in-place and restricts access for a user to access other user's activity access. That data is shown on the profile page.

This PR leverages the same config key to enable/disable links and access to profiles from dashboards and charts.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

With ENABLE_BROAD_ACTIVITY_ACCESS = True (default) nothing changes

With ENABLE_BROAD_ACTIVITY_ACCESS = False

Trying to access other user's profile, by changing the URL directly:

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

…_ACTIVITY_ACCESS

codecov · 2022-09-01T20:05:41Z

Codecov Report

Merging #21302 (8b1bd5a) into master (ad34f9d) will increase coverage by 0.05%.
The diff coverage is 73.20%.

❗ Current head 8b1bd5a differs from pull request most recent head 9c8d88a. Consider uploading reports for the commit 9c8d88a to get more accurate results

@@            Coverage Diff             @@
##           master   #21302      +/-   ##
==========================================
+ Coverage   66.44%   66.50%   +0.05%     
==========================================
  Files        1784     1789       +5     
  Lines       68237    68381     +144     
  Branches     7263     7279      +16     
==========================================
+ Hits        45342    45474     +132     
+ Misses      21026    21020       -6     
- Partials     1869     1887      +18

Flag	Coverage Δ
hive	`52.94% <46.35%> (-0.05%)`	⬇️
mysql	`80.82% <75.49%> (+<0.01%)`	⬆️
postgres	`80.87% <75.49%> (+<0.01%)`	⬆️
presto	`52.84% <46.35%> (-0.05%)`	⬇️
python	`81.33% <75.49%> (-0.02%)`	⬇️
sqlite	`79.42% <75.49%> (-0.01%)`	⬇️
unit	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...cy-preset-chart-nvd3/src/TimePivot/controlPanel.ts	`50.00% <ø> (ø)`
...hart-echarts/src/MixedTimeseries/transformProps.ts	`0.00% <0.00%> (ø)`
superset-frontend/src/SqlLab/App.jsx	`0.00% <0.00%> (ø)`
...d/src/SqlLab/components/TabbedSqlEditors/index.jsx	`54.23% <0.00%> (-0.94%)`	⬇️
...ntend/src/SqlLab/components/TableElement/index.tsx	`72.30% <ø> (ø)`
...tend/src/dashboard/components/AnchorLink/index.tsx	`81.25% <ø> (ø)`
superset-frontend/src/utils/localStorageHelpers.ts	`90.00% <ø> (ø)`
superset-frontend/src/views/App.tsx	`0.00% <0.00%> (ø)`
...aseModal/DatabaseConnectionForm/EncryptedField.tsx	`10.00% <ø> (ø)`
...c/views/CRUD/data/database/DatabaseModal/styles.ts	`76.69% <ø> (ø)`
... and 58 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

geido · 2022-09-02T11:37:05Z

superset-frontend/src/views/CRUD/chart/ChartList.tsx

+        }: any) =>
+          enableBroadUserAccess ? (
+            <a href={changedByUrl}>
+              {lastSavedBy?.first_name


A minor enhancement, but since this is the same as the one below, can you please put it in a separate constant and just reference it in both places

geido · 2022-09-02T11:39:06Z

superset/config.py

@@ -1335,6 +1335,7 @@ def EMAIL_HEADER_MUTATOR(  # pylint: disable=invalid-name,unused-argument
 MENU_HIDE_USER_INFO = False

 # Set to False to only allow viewing own recent activity
+# or to disallow users from viewing other users profile page


Looking at the code we are just removing the links to the profiles. Is there anything else that is actually blocking the user to visit a profile?

Yes, on the backend change, the call to get_user_activity_access_error will assert if ENABLE_BROAD_ACTIVITY_ACCESS is True or not, if it's False and the user_id is not equal to the current user, the response will be 403 with an error msg. Following same pattern already in-place on other endpoints on /superset.

Ok thanks for adding that

geido

LGTM!

villebro

LGTM with a miniscule nit

villebro · 2022-09-03T05:48:15Z

superset-frontend/src/views/CRUD/chart/ChartList.tsx

@@ -213,14 +215,19 @@ function ChartList(props: ChartListProps) {
  const canExport =
    hasPerm('can_export') && isFeatureEnabled(FeatureFlag.VERSIONED_EXPORT);
  const initialSort = [{ id: 'changed_on_delta_humanized', desc: true }];
-
+  const enableBroadUserAccess =
+    bootstrapData?.common?.conf?.ENABLE_BROAD_ACTIVITY_ACCESS || false;


Probably better safe than sorry, but in a similar context on the backend we always do config["ENABLE_BROAD_ACTIVITY_ACCESS"] instead of ``config.get("ENABLE_BROAD_ACTIVITY_ACCESS")`, since we assume the variable should always be defined. So maybe we could get by with

Suggested change

bootstrapData?.common?.conf?.ENABLE_BROAD_ACTIVITY_ACCESS || false;

bootstrapData?.common?.conf?.ENABLE_BROAD_ACTIVITY_ACCESS;

(arguably that whole bootstrapData object with all nested fields should also be fully available)

villebro · 2022-09-03T05:49:37Z

superset-frontend/src/views/CRUD/dashboard/DashboardList.tsx

@@ -132,6 +133,8 @@ function DashboardList(props: DashboardListProps) {
  const [importingDashboard, showImportModal] = useState<boolean>(false);
  const [passwordFields, setPasswordFields] = useState<string[]>([]);
  const [preparingExport, setPreparingExport] = useState<boolean>(false);
+  const enableBroadUserAccess =
+    bootstrapData?.common?.conf?.ENABLE_BROAD_ACTIVITY_ACCESS || false;


…he#21302)

fix: disallow users from viewing other user's profile on ENABLE_BROAD…

54cfc53

…_ACTIVITY_ACCESS

pull-request-size bot added the size/M label Sep 1, 2022

fix FE test

37c65be

geido reviewed Sep 2, 2022

View reviewed changes

dpgaspar requested review from geido, villebro, bkyryliuk and john-bodley September 2, 2022 13:26

dpgaspar added 2 commits September 2, 2022 14:47

add test

35f792b

fix lint

0648ae1

michael-s-molina added the v1.5 label Sep 2, 2022

geido approved these changes Sep 2, 2022

View reviewed changes

michael-s-molina added the v2.0 label Sep 2, 2022

villebro approved these changes Sep 3, 2022

View reviewed changes

address comment

9c8d88a

dpgaspar merged commit c3f8417 into apache:master Sep 5, 2022

dpgaspar deleted the danielgaspar/sc-53411/fix-user-profile-endpoint-reported-vulnerability branch September 5, 2022 12:32

michael-s-molina pushed a commit that referenced this pull request Sep 6, 2022

fix: disallow users from viewing other user's profile on config (#21302)

8e7fb96

eschutho pushed a commit that referenced this pull request Sep 20, 2022

fix: disallow users from viewing other user's profile on config (#21302)

79351a4

AAfghahi pushed a commit that referenced this pull request Oct 5, 2022

fix: disallow users from viewing other user's profile on config (#21302)

4c5fb9d

AAfghahi pushed a commit that referenced this pull request Oct 6, 2022

fix: disallow users from viewing other user's profile on config (#21302)

dd919bc

Fahrenheit35 pushed a commit to Fahrenheit35/superset that referenced this pull request Nov 11, 2022

fix: disallow users from viewing other user's profile on config (apac…

1a167cf

…he#21302)

michael-s-molina added v1.5 and removed v1.5 labels Jan 3, 2023

mistercrunch added 🍒 1.5.2 🍒 1.5.3 🍒 2.0.1 labels Feb 18, 2024

mistercrunch added 🚢 2.1.3 🚢 2.1.0 and removed 🍒 2.0.1 🍒 1.5.3 🍒 1.5.2 🚢 2.1.3 🚢 2.1.0 labels Feb 18, 2024

mistercrunch added 🍒 1.5.2 🍒 1.5.3 🍒 2.0.1 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 2.1.0 and removed 🚢 2.1.3 labels Mar 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: disallow users from viewing other user's profile on config #21302

fix: disallow users from viewing other user's profile on config #21302

dpgaspar commented Sep 1, 2022 •

edited

codecov bot commented Sep 1, 2022 •

edited

geido Sep 2, 2022

geido Sep 2, 2022

dpgaspar Sep 2, 2022 •

edited

geido Sep 2, 2022

geido left a comment

villebro left a comment

villebro Sep 3, 2022

villebro Sep 3, 2022

	bootstrapData?.common?.conf?.ENABLE_BROAD_ACTIVITY_ACCESS \|\| false;
	bootstrapData?.common?.conf?.ENABLE_BROAD_ACTIVITY_ACCESS;

fix: disallow users from viewing other user's profile on config #21302

fix: disallow users from viewing other user's profile on config #21302

Conversation

dpgaspar commented Sep 1, 2022 • edited

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

codecov bot commented Sep 1, 2022 • edited

Codecov Report

geido Sep 2, 2022

Choose a reason for hiding this comment

geido Sep 2, 2022

Choose a reason for hiding this comment

dpgaspar Sep 2, 2022 • edited

Choose a reason for hiding this comment

geido Sep 2, 2022

Choose a reason for hiding this comment

geido left a comment

Choose a reason for hiding this comment

villebro left a comment

Choose a reason for hiding this comment

villebro Sep 3, 2022

Choose a reason for hiding this comment

villebro Sep 3, 2022

Choose a reason for hiding this comment

dpgaspar commented Sep 1, 2022 •

edited

codecov bot commented Sep 1, 2022 •

edited

dpgaspar Sep 2, 2022 •

edited