浏览代码

HUE-3410 [editor] Secure persisting the parent saved query

Romain Rigaux 9 年之前
父节点
当前提交
d406433098

+ 2 - 3
desktop/libs/notebook/src/notebook/api.py

@@ -94,8 +94,6 @@ def execute(request):
       response['history_uuid'] = history.uuid
       if notebook['isSaved']: # Keep track of history of saved queries
         response['history_parent_uuid'] = history.dependencies.filter(type__startswith='query-').latest('last_modified').uuid
-      print notebook['isSaved']
-      print notebook
 
   # Materialize and HTML escape results
   if response['handle'].get('sync') and response['handle']['result'].get('data'):
@@ -247,7 +245,8 @@ def save_notebook(request):
     parent_directory = Document2.objects.get_by_uuid(parent_uuid)
 
   if notebook.get('parentUuid'):
-    notebook_doc = Document2.objects.get(uuid=notebook['parentUuid']) # TODO security
+    notebook_doc = Document2.objects.get(uuid=notebook['parentUuid'])
+    notebook_doc.can_read_or_exception(notebook['parentUuid'])
   elif notebook.get('id'):
     notebook_doc = Document2.objects.get(id=notebook['id'])
   else:

+ 8 - 9
desktop/libs/notebook/src/notebook/static/notebook/js/notebook.ko.js

@@ -1000,11 +1000,11 @@
     var self = this;
 
     self.id = ko.observable(typeof notebook.id != "undefined" && notebook.id != null ? notebook.id : null);
-    self.uuid = ko.observable(typeof notebook.uuid != "undefined" && notebook.uuid != null ? notebook.uuid : UUID());    
+    self.uuid = ko.observable(typeof notebook.uuid != "undefined" && notebook.uuid != null ? notebook.uuid : UUID());
     self.name = ko.observable(typeof notebook.name != "undefined" && notebook.name != null ? notebook.name : 'My Notebook');
     self.description = ko.observable(typeof notebook.description != "undefined" && notebook.description != null ? notebook.description: '');
     self.type = ko.observable(typeof notebook.type != "undefined" && notebook.type != null ? notebook.type : 'notebook');
-    self.isHistory = ko.observable(typeof notebook.is_history != "undefined" && notebook.is_history != null ? notebook.is_history : false);	
+    self.isHistory = ko.observable(typeof notebook.is_history != "undefined" && notebook.is_history != null ? notebook.is_history : false);
     self.parentUuid = ko.observable(typeof notebook.parentUuid != "undefined" && notebook.parentUuid != null ? notebook.parentUuid : null); // History parent
     self.isSaved = ko.observable(typeof notebook.isSaved != "undefined" && notebook.isSaved != null ? notebook.isSaved : false);
     self.snippets = ko.observableArray();
@@ -1423,13 +1423,12 @@
     self.successUrl = ko.observable(options.success_url);
     self.isOptimizerEnabled = ko.observable(options.is_optimizer_enabled);
     self.canSave = ko.computed(function() {
-        // Saved query or history but history coming from a saved query
-        return self.selectedNotebook() && (
-        		  self.selectedNotebook().isSaved() ||
-        		  //(! self.selectedNotebook().isSaved() && self.selectedNotebook().isHistory() && self.selectedNotebook().parentUuid()) ||
-      			  (self.selectedNotebook().isHistory() && self.selectedNotebook().parentUuid())
-        );
-      });
+      // Saved query or history but history coming from a saved query
+      return self.selectedNotebook() && (
+         self.selectedNotebook().isSaved() ||
+         (self.selectedNotebook().isHistory() && self.selectedNotebook().parentUuid())
+      );
+    });
 
     self.sqlSourceTypes = [];
 

+ 1 - 1
desktop/libs/notebook/src/notebook/templates/editor_components.mako

@@ -1033,7 +1033,7 @@ ${ hueIcons.symbols() }
           <table class="table table-condensed margin-top-10 history-table">
             <tbody data-bind="foreach: $parent.history">
               <tr class="pointer" data-bind="click: function() { if (getSelection().toString().length == 0) { $root.openNotebook(uuid) } }">
-                <td style="width: 100px" class="muted" data-bind="style: {'border-top-width': $index() == 0 ? '0' : ''}"><span data-bind="text: moment(lastExecuted).fromNow(), attr: {title: moment(lastExecuted).format('LLL')}"></span></td>                
+                <td style="width: 100px" class="muted" data-bind="style: {'border-top-width': $index() == 0 ? '0' : ''}"><span data-bind="text: moment(lastExecuted).fromNow(), attr: {title: moment(lastExecuted).format('LLL')}"></span></td>
                 <td style="width: 25px" class="muted" data-bind="style: {'border-top-width': $index() == 0 ? '0' : ''}">
                   <!-- ko switch: status -->
                   <!-- ko case: 'running' -->