Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User can access draft dashboard with permalink that established when dashboard was published #27588

Closed
3 tasks done
unnyns-307 opened this issue Mar 20, 2024 · 3 comments
Closed
3 tasks done
Assignees

Comments

@unnyns-307
Copy link

Bug description

Hi all,

I got report from our colleague when user can still access our draft dashboard which we once published it and shared dashboard's permalink with user. Normally, user shouldn't be able to access the dashboard once it was set to draft but they still able to access the dashboard with previous permalink we shared with them. However, they might see the error prompt up at the right bottom of the screen
Note: Users only have permission of ALPHA role

How to reproduce the bug

  1. Go to your dashboard > set it status to 'Publish'
  2. Copy the shareable link from your dashboard setting
  3. Share dashboard link with another user who is not an owner on dashboard or doesn't has Admin privilege
  4. Let user try to access dashboard through permalink *they shall be able to access
  5. Switch the dashboard status to 'Draft'
  6. Let user try to access dashboard through permalink again *they still can access the dashboard
    but they are not able to search for dashboard on the dashboard page or access dashboard with SLUG URL or dashboard URL link with only dashboard ID

Screenshots/recordings

No response

Superset version

3.0.4

Python version

3.9

Node version

16

Browser

Chrome

Additional context

No response

Checklist

  • I have searched Superset docs and Slack and didn't find a solution to my problem.
  • I have searched the GitHub issue tracker and didn't find a similar bug report.
  • I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
@dpgaspar
Copy link
Member

dpgaspar commented Dec 9, 2024

Thank you for opening the issue, but we will close this on github, please follow: https://github.com/apache/superset/security/policy

@dpgaspar dpgaspar closed this as completed Dec 9, 2024
@Habeeb556
Copy link
Contributor

Hello @dpgaspar, does this issue resolved? as I still see it in version 4.1.1

@rusackas
Copy link
Member

Locking issue... please follow up via the process/link provided if needed.

@apache apache locked and limited conversation to collaborators Mar 11, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants