fix(dashboard): check edit permissions correctly on frontend #14626
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## master #14626 +/- ##
==========================================
+ Coverage 77.47% 77.51% +0.03%
==========================================
Files 959 959
Lines 48492 48853 +361
Branches 5681 5830 +149
==========================================
+ Hits 37569 37867 +298
- Misses 10723 10782 +59
- Partials 200 204 +4
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
suddjian
force-pushed
the
fix-dash-edit-permission
branch
2 times, most recently
from
189e22e
to
0ba22d3
Compare
suddjian
force-pushed
the
fix-dash-edit-permission
branch
from
0ba22d3
to
784b128
Compare
|
@suddjian hi Aaron, can you add manual test plan for our QA team to help test? thanks 😊 |
|
Done @junlincc thank you for the heads up |
pkdotson
reviewed
May 14, 2021
| @@ -25,8 +25,9 @@ export const useDashboard = (idOrSlug: string | number) => | |||
| useApiV1Resource<Dashboard>(`/api/v1/dashboard/${idOrSlug}`), | |||
| dashboard => ({ | |||
| ...dashboard, | |||
| metadata: JSON.parse(dashboard.json_metadata), | |||
| position_data: JSON.parse(dashboard.position_json), | |||
| metadata: dashboard.json_metadata && JSON.parse(dashboard.json_metadata), | |||
There was a problem hiding this comment.
should this be initialized as a empty object if dashboard comes back as undefined.
There was a problem hiding this comment.
I assume you mean if the metadata is undefined (if the dashboard is undefined it will be a 404). I don't think it should be initialized like that, null is different from an empty object.
This is not actually new behavior, I just had to write this guard to appease the type system since I corrected the types of some dashboard fields to be nullable.
nytai
approved these changes
May 14, 2021
3 tasks
|
fixes #14442 |
3 tasks
junlincc
added
rush!
cccs-RyanS
pushed a commit
to CybercentreCanada/superset
that referenced
this pull request
Dec 17, 2021
…14626) * fix(dashboard): check edit permissions correctly on frontend * fix types, appease linter * handle nulls better
QAlexBall
pushed a commit
to QAlexBall/superset
that referenced
this pull request
Dec 29, 2021
…14626) * fix(dashboard): check edit permissions correctly on frontend * fix types, appease linter * handle nulls better
cccs-rc
pushed a commit
to CybercentreCanada/superset
that referenced
this pull request
Mar 6, 2024
…14626) * fix(dashboard): check edit permissions correctly on frontend * fix types, appease linter * handle nulls better
mistercrunch
added
🏷️ bot
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SUMMARY
This fixes a case where users who were not owners of a dashboard were incorrectly seeing the "Edit" button. This is not a security hole as the users cannot successfully submit their edits, but it was incorrect UI that needed to be fixed.
The frontend was incorrectly inferring dashboard edit permissions. This change fixes the issue by copying logic from the backend's check_ownership function.
The code of the frontend version implements the same check, while being much simpler than the backend version due to being a pure function, dashboard-specific, and not having parameterized function behavior.
I did this instead of changing endpoints, because the caching of the existing dashboard endpoints depends on returning the same data to all users, and because implementing a new endpoint to just return a boolean felt wrong.
TEST PLAN
ADDITIONAL INFORMATION