pt
/
superset
mirror of https://github.com/apache/superset.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

remove user params (#6345)

This commit is contained in:
timifasubaa 2018-11-13 09:27:08 -08:00 committed by GitHub
parent 8e2d28dd6e
commit d9a7d565a0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
superset/security.py
View File

@ -83,36 +83,35 @@ class SupersetSecurityManager(SecurityManager):
if schema: if schema:
return '[{}].[{}]'.format(database, schema) return '[{}].[{}]'.format(database, schema)
def can_access(self, permission_name, view_name, user=None): def can_access(self, permission_name, view_name):
"""Protecting from has_access failing from missing perms/view""" """Protecting from has_access failing from missing perms/view"""
if not user: user = g.user
user = g.user
if user.is_anonymous: if user.is_anonymous:
return self.is_item_public(permission_name, view_name) return self.is_item_public(permission_name, view_name)
return self._has_view_access(user, permission_name, view_name) return self._has_view_access(user, permission_name, view_name)
def all_datasource_access(self, user=None): def all_datasource_access(self):
return self.can_access( return self.can_access(
'all_datasource_access', 'all_datasource_access', user=user) 'all_datasource_access', 'all_datasource_access')
def database_access(self, database, user=None): def database_access(self, database):
return ( return (
self.can_access( self.can_access(
'all_database_access', 'all_database_access', user=user) or 'all_database_access', 'all_database_access') or
self.can_access('database_access', database.perm, user=user) self.can_access('database_access', database.perm)
) )
def schema_access(self, datasource, user=None): def schema_access(self, datasource):
return ( return (
self.database_access(datasource.database, user=user) or self.database_access(datasource.database) or
self.all_datasource_access(user=user) or self.all_datasource_access() or
self.can_access('schema_access', datasource.schema_perm, user=user) self.can_access('schema_access', datasource.schema_perm)
) )
def datasource_access(self, datasource, user=None): def datasource_access(self, datasource):
return ( return (
self.schema_access(datasource, user=user) or self.schema_access(datasource) or
self.can_access('datasource_access', datasource.perm, user=user) self.can_access('datasource_access', datasource.perm)
) )
def get_datasource_access_error_msg(self, datasource): def get_datasource_access_error_msg(self, datasource):
@ -430,8 +429,8 @@ class SupersetSecurityManager(SecurityManager):
), ),
) )
def assert_datasource_permission(self, datasource, user=None): def assert_datasource_permission(self, datasource):
if not self.datasource_access(datasource, user): if not self.datasource_access(datasource):
raise SupersetSecurityException( raise SupersetSecurityException(
self.get_datasource_access_error_msg(datasource), self.get_datasource_access_error_msg(datasource),
self.get_datasource_access_link(datasource), self.get_datasource_access_link(datasource),

5
superset/views/core.py
View File

@ -905,9 +905,8 @@ class Superset(BaseSupersetView):
for r in session.query(DAR).all(): for r in session.query(DAR).all():
datasource = ConnectorRegistry.get_datasource( datasource = ConnectorRegistry.get_datasource(
r.datasource_type, r.datasource_id, session) r.datasource_type, r.datasource_id, session)
user = security_manager.get_user_by_id(r.created_by_fk)
if not datasource or \ if not datasource or \
security_manager.datasource_access(datasource, user): security_manager.datasource_access(datasource):
# datasource does not exist anymore # datasource does not exist anymore
session.delete(r) session.delete(r)
session.commit() session.commit()
@ -1121,7 +1120,7 @@ class Superset(BaseSupersetView):
form_data=form_data, form_data=form_data,
force=force, force=force,
) )
security_manager.assert_datasource_permission(viz_obj.datasource, g.user) security_manager.assert_datasource_permission(viz_obj.datasource)
if csv: if csv:
return CsvResponse( return CsvResponse(