Skip to content

Only allow owners to overwrite slice #2142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mistercrunch merged 2 commits into from
Feb 10, 2017
Merged

Only allow owners to overwrite slice #2142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9a119e7
Raise exception when date range is wrong
vera-liu Feb 9, 2017
e08f9e9
Only allow owner to overwrite a slice
vera-liu Feb 9, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions superset/assets/javascripts/explorev2/components/SaveModal.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import Select from 'react-select';
import { connect } from 'react-redux';

const propTypes = {
can_edit: PropTypes.bool,
can_overwrite: PropTypes.bool,
onHide: PropTypes.func.isRequired,
actions: PropTypes.object.isRequired,
form_data: PropTypes.object,
Expand All @@ -26,7 +26,7 @@ class SaveModal extends React.Component {
newSliceName: '',
dashboards: [],
alert: null,
action: 'overwrite',
action: 'saveas',
addToDash: 'noSave',
};
}
Expand Down Expand Up @@ -140,7 +140,7 @@ class SaveModal extends React.Component {
</Alert>
}
<Radio
disabled={!this.props.can_edit}
disabled={!this.props.can_overwrite}
checked={this.state.action === 'overwrite'}
onChange={this.changeAction.bind(this, 'overwrite')}
>
Expand Down Expand Up @@ -229,7 +229,7 @@ function mapStateToProps(state) {
return {
datasource: state.datasource,
slice: state.slice,
can_edit: state.can_edit,
can_overwrite: state.can_overwrite,
user_id: state.user_id,
dashboards: state.dashboards,
alert: state.saveModalAlert,
Expand Down
29 changes: 15 additions & 14 deletions superset/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,11 @@ def wraps(self, *args, **kwargs):

return functools.update_wrapper(wraps, f)

def is_owner(obj, user):
""" Check if user is owner of the slice """
if obj.owners and user in obj.owners:
return True
return False

def check_ownership(obj, raise_if_false=True):
"""Meant to be used in `pre_update` hooks on models to enforce ownership
Expand Down Expand Up @@ -1550,7 +1555,7 @@ def explore(self, datasource_type, datasource_id):

# slc perms
slice_add_perm = self.can_access('can_add', 'SliceModelView')
slice_edit_perm = check_ownership(slc, raise_if_false=False)
slice_overwrite_perm = is_owner(slc, g.user)
slice_download_perm = self.can_access('can_download', 'SliceModelView')

# handle save or overwrite
Expand All @@ -1559,7 +1564,7 @@ def explore(self, datasource_type, datasource_id):
return self.save_or_overwrite_slice(
request.args,
slc, slice_add_perm,
slice_edit_perm,
slice_overwrite_perm,
datasource_id,
datasource_type)

Expand All @@ -1568,7 +1573,7 @@ def explore(self, datasource_type, datasource_id):
bootstrap_data = {
"can_add": slice_add_perm,
"can_download": slice_download_perm,
"can_edit": slice_edit_perm,
"can_overwrite": slice_overwrite_perm,
"datasource": datasource.data,
# TODO: separate endpoint for fetching datasources
"form_data": form_data,
Expand Down Expand Up @@ -1637,7 +1642,7 @@ def filter(self, datasource_type, datasource_id, column):
mimetype="application/json")

def save_or_overwrite_slice(
self, args, slc, slice_add_perm, slice_edit_perm,
self, args, slc, slice_add_perm, slice_overwrite_perm,
datasource_id, datasource_type):
"""Save or overwrite a slice"""
slice_name = args.get('slice_name')
Expand All @@ -1661,7 +1666,7 @@ def save_or_overwrite_slice(

if action in ('saveas') and slice_add_perm:
self.save_slice(slc)
elif action == 'overwrite' and slice_edit_perm:
elif action == 'overwrite' and slice_overwrite_perm:
self.overwrite_slice(slc)

# Adding slice to a dashboard if requested
Expand Down Expand Up @@ -1705,15 +1710,11 @@ def save_slice(self, slc):
flash(msg, "info")

def overwrite_slice(self, slc):
can_update = check_ownership(slc, raise_if_false=False)
if not can_update:
flash("You cannot overwrite [{}]".format(slc), "danger")
else:
session = db.session()
session.merge(slc)
session.commit()
msg = "Slice [{}] has been overwritten".format(slc.slice_name)
flash(msg, "info")
session = db.session()
session.merge(slc)
session.commit()
msg = "Slice [{}] has been overwritten".format(slc.slice_name)
flash(msg, "info")

@api
@has_access_api
Expand Down
6 changes: 2 additions & 4 deletions superset/viz.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,8 +163,7 @@ def query_obj(self):
until = extra_filters.get('__to') or form_data.get("until", "now")
to_dttm = utils.parse_human_datetime(until)
if from_dttm > to_dttm:
flasher("The date range doesn't seem right.", "danger")
from_dttm = to_dttm # Making them identical to not raise
raise Exception("From date cannot be larger than to date")

# extras are used to query elements specific to a datasource type
# for instance the extra where clause that applies only to Tables
Expand Down Expand Up @@ -329,8 +328,7 @@ def get_values_for_column(self, column):
until = form_data.get("until", "now")
to_dttm = utils.parse_human_datetime(until)
if from_dttm > to_dttm:
flasher("The date range doesn't seem right.", "danger")
from_dttm = to_dttm # Making them identical to not raise
raise Exception("From date cannot be larger than to date")

kwargs = dict(
column_name=column,
Expand Down