From 375f9f0322f44a62aef63d679540add8eea9a146 Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Thu, 10 Sep 2026 16:10:18 -0700 Subject: [PATCH] Check effective table visibility for through filters --- datasette/filters.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/datasette/filters.py b/datasette/filters.py index 10f5d16f..c119c255 100644 --- a/datasette/filters.py +++ b/datasette/filters.py @@ -133,6 +133,14 @@ def through_filters(request, database, table, datasette): through_table = through_data["table"] other_column = through_data["column"] value = through_data["value"] + await datasette.ensure_permissions( + request.actor, + [ + ("view-table", (database, through_table)), + ("view-database", database), + "view-instance", + ], + ) db = datasette.get_database(database) outgoing_foreign_keys = await db.foreign_keys_for_table(through_table) try: