Skip to content
Snippets Groups Projects
This project is mirrored from https://github.com/metabase/metabase. Pull mirroring updated .
  1. Feb 02, 2018
  2. Feb 01, 2018
  3. Jan 31, 2018
  4. Jan 30, 2018
  5. Jan 29, 2018
  6. Jan 27, 2018
  7. Jan 26, 2018
    • Sameer Al-Sakran's avatar
      fix_6781_sync_controls · 265f2784
      Sameer Al-Sakran authored
      265f2784
    • Ryan Senior's avatar
      Merge pull request #6791 from metabase/fix-dashcard-series-perms · c952a60a
      Ryan Senior authored
      Ensure collection_id is included in series dashcards
      c952a60a
    • Ryan Senior's avatar
      Ensure collection_id is included in series dashcards · 5f3e5bea
      Ryan Senior authored
      Hydrating series dashcards wasn't including the related collection
      id. The collection id is one way in which permissions are
      checked. This would manifest itself in the user having access to
      something they shouldn't. As an example, if a dashboard had a single
      card that was part of a collection the user wouldn't have access to,
      and the user attempted to access it, they would get a 403. If a second
      card was added and that card contained multiple (i.e. a series) due to
      this bug, the second card wouldn't have a collection_id and thus we'd
      assume the user has access to it. The permissions checking on the
      dashboard only checks whether or not the user has access to at least
      one card in the dashboard, thus giving user access to the dashboard.
      
      Fixes #5266
      5f3e5bea
  8. Jan 25, 2018
Loading