github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Foreign key label expanding respects table permissions, closes #2178

Browse source
This commit is contained in:
Simon Willison 2023-09-07 15:51:09 -07:00
commit dbfad6d220
4 changed files with 63 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
datasette/app.py
View file

@ -935,7 +935,7 @@ class Datasette:
log_sql_errors=log_sql_errors,
)
async def expand_foreign_keys(self, database, table, column, values):
async def expand_foreign_keys(self, actor, database, table, column, values):
"""Returns dict mapping (column, value) -> label"""
labeled_fks = {}
db = self.databases[database]
@ -949,6 +949,13 @@ class Datasette:
][0]
except IndexError:
return {}
# Ensure user has permission to view the referenced table
if not await self.permission_allowed(
actor=actor,
action="view-table",
resource=(database, fk["other_table"]),
):
return {}
label_column = await db.label_column_for_table(fk["other_table"])
if not label_column:
return {(fk["column"], value): str(value) for value in values}