Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[security] Fix, let admin's be able to reset user passwords on AUTH_DB #9232

Merged
merged 2 commits into from Mar 3, 2020
Merged

[security] Fix, let admin's be able to reset user passwords on AUTH_DB #9232

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6561462
[security] Fix, let admin's be able to reset user passwords on AUTH_DB
dpgaspar Mar 3, 2020
3963f25
[security] Fix, use constants
dpgaspar Mar 3, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 5 additions & 1 deletion superset/security/manager.py
View file
Open in desktop
Expand Up @@ -81,7 +81,11 @@ def __init__(self, **kwargs):
PermissionModelView.list_widget = SupersetSecurityListWidget

# Limiting routes on FAB model views
UserModelView.include_route_methods = RouteMethod.CRUD_SET | {"userinfo"}
UserModelView.include_route_methods = RouteMethod.CRUD_SET | {
"userinfo",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The userinfo looks lonely here with the constants. Wondering if we should collect these somewhere, too.

Copy link
Member Author

@dpgaspar dpgaspar Mar 3, 2020 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can of course, did a quick search and found a bunch of "lonely" routes. Like download_dashboards, bulk_delete, table_metadata. Would say that the idea here is that non repeatable ones, get referenced in place.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps not something that needs to be addressed now (not really sure which is better). LGTM

"action_post",
"action",
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be using constants.RouteMethod.ACTION_POST etc here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh! yes, right you are

RoleModelView.include_route_methods = RouteMethod.CRUD_SET
PermissionViewModelView.include_route_methods = {RouteMethod.LIST}
PermissionModelView.include_route_methods = {RouteMethod.LIST}
Expand Down