mirror of
https://github.com/apache/superset.git
synced 2024-09-12 00:29:39 -04:00
fix: query search low privileged user search access denied (#11017)
This commit is contained in:
parent
50852dfbbf
commit
ba009b7c09
@ -2469,13 +2469,14 @@ class Superset(BaseSupersetView): # pylint: disable=too-many-public-methods
|
||||
|
||||
:returns: Response with list of sql query dicts
|
||||
"""
|
||||
query = db.session.query(Query)
|
||||
if security_manager.can_access_all_queries():
|
||||
search_user_id = request.args.get("user_id")
|
||||
elif (
|
||||
request.args.get("user_id") is not None
|
||||
and request.args.get("user_id") != g.user.get_user_id()
|
||||
):
|
||||
elif request.args.get("user_id") is not None:
|
||||
try:
|
||||
search_user_id = int(cast(int, request.args.get("user_id")))
|
||||
except ValueError:
|
||||
return Response(status=400, mimetype="application/json")
|
||||
if search_user_id != g.user.get_user_id():
|
||||
return Response(status=403, mimetype="application/json")
|
||||
else:
|
||||
search_user_id = g.user.get_user_id()
|
||||
@ -2486,6 +2487,7 @@ class Superset(BaseSupersetView): # pylint: disable=too-many-public-methods
|
||||
from_time = request.args.get("from")
|
||||
to_time = request.args.get("to")
|
||||
|
||||
query = db.session.query(Query)
|
||||
if search_user_id:
|
||||
# Filter on user_id
|
||||
query = query.filter(Query.user_id == search_user_id)
|
||||
@ -2500,7 +2502,7 @@ class Superset(BaseSupersetView): # pylint: disable=too-many-public-methods
|
||||
|
||||
if search_text:
|
||||
# Filter on search text
|
||||
query = query.filter(Query.sql.like("%{}%".format(search_text)))
|
||||
query = query.filter(Query.sql.like(f"%{search_text}%"))
|
||||
|
||||
if from_time:
|
||||
query = query.filter(Query.start_time > int(from_time))
|
||||
|
Loading…
Reference in New Issue
Block a user