Skip to content

Commit

Permalink
update config name
Browse files Browse the repository at this point in the history
  • Loading branch information
villebro committed Dec 7, 2021
1 parent f0df8ef commit e7b1272
Show file tree
Hide file tree
Showing 4 changed files with 6 additions and 6 deletions.
2 changes: 1 addition & 1 deletion UPDATING.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ assists people when migrating to a new version.

### Other

- [17589](https://github.com/apache/incubator-superset/pull/17589): It is now possible to limit access to users' recent activity data by setting the `ENABLE_PUBLIC_ACTIVITY_ACCESS` config flag to false, or customizing the `raise_for_user_activity_access` method in the security manager.
- [17589](https://github.com/apache/incubator-superset/pull/17589): It is now possible to limit access to users' recent activity data by setting the `ENABLE_BROAD_ACTIVITY_ACCESS` config flag to false, or customizing the `raise_for_user_activity_access` method in the security manager.
- [16809](https://github.com/apache/incubator-superset/pull/16809): When building the superset frontend assets manually, you should now use Node 16 (previously Node 14 was required/recommended). Node 14 will most likely still work for at least some time, but is no longer actively tested for on CI.

## 1.3.0
Expand Down
2 changes: 1 addition & 1 deletion superset/config.py
Original file line number Diff line number Diff line change
Expand Up @@ -1285,7 +1285,7 @@ def SQL_QUERY_MUTATOR( # pylint: disable=invalid-name,unused-argument
SQLALCHEMY_DISPLAY_TEXT = "SQLAlchemy docs"

# Set to False to only allow viewing own recent activity
ENABLE_PUBLIC_ACTIVITY_ACCESS = True
ENABLE_BROAD_ACTIVITY_ACCESS = True

# -------------------------------------------------------------------
# * WARNING: STOP EDITING HERE *
Expand Down
2 changes: 1 addition & 1 deletion superset/security/manager.py
Original file line number Diff line number Diff line change
Expand Up @@ -1164,7 +1164,7 @@ def get_rls_ids(self, table: "BaseDatasource") -> List[int]:
def raise_for_user_activity_access(user_id: int) -> None:
user = g.user if g.user and g.user.get_id() else None
if not user or (
not current_app.config["ENABLE_PUBLIC_ACTIVITY_ACCESS"]
not current_app.config["ENABLE_BROAD_ACTIVITY_ACCESS"]
and user_id != user.id
):
raise SupersetSecurityException(
Expand Down
6 changes: 3 additions & 3 deletions tests/integration_tests/core_tests.py
Original file line number Diff line number Diff line change
Expand Up @@ -836,16 +836,16 @@ def test_user_activity_access(self, username="gamma"):
assert resp.status_code == 200

# disabling flag will block access to other users' activity data
access_flag = app.config["ENABLE_PUBLIC_ACTIVITY_ACCESS"]
app.config["ENABLE_PUBLIC_ACTIVITY_ACCESS"] = False
access_flag = app.config["ENABLE_BROAD_ACTIVITY_ACCESS"]
app.config["ENABLE_BROAD_ACTIVITY_ACCESS"] = False
for user in ("admin", "gamma"):
for endpoint in self._get_user_activity_endpoints(user):
resp = self.client.get(endpoint)
expected_status_code = 200 if user == username else 403
assert resp.status_code == expected_status_code

# restore flag
app.config["ENABLE_PUBLIC_ACTIVITY_ACCESS"] = access_flag
app.config["ENABLE_BROAD_ACTIVITY_ACCESS"] = access_flag

@pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
def test_slice_id_is_always_logged_correctly_on_web_request(self):
Expand Down

0 comments on commit e7b1272

Please sign in to comment.