Field values cache needs to check permissions (#38104)
* Field values cache needs to check permissions If a user does not have permissions to the field, we should not return the cached field values. * Update default-get-or-create-field-values-for-current-user to check can-read too * Revert params.field-values change * Use query processor permissions checks before returning cached values * Return true from check * Fix test * Check for ee config
Showing
- src/metabase/models/params/chain_filter.clj 11 additions, 1 deletionsrc/metabase/models/params/chain_filter.clj
- src/metabase/query_processor/middleware/permissions.clj 1 addition, 1 deletionsrc/metabase/query_processor/middleware/permissions.clj
- test/metabase/api/dashboard_test.clj 42 additions, 1 deletiontest/metabase/api/dashboard_test.clj
Loading
Please register or sign in to comment