remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-27 04:14:25 +02:00
Code Issues Projects Releases Packages Wiki Activity

Clearly document relationship between execute-sql and facets

Browse source 
Refs GHSA-5fff-xcm9-q6vh

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
This commit is contained in:
Simon Willison 2026-09-03 14:36:46 -07:00
commit 6473a7ecb0
3 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/authentication.rst
View file

@ -771,6 +771,8 @@ Datasette defaults to allowing any site visitor to execute their own custom SQL
Access to this ability is controlled by the :ref:`actions_execute_sql` permission.
This permission does not apply to structured table-browsing operations where Datasette constructs the SQL, such as sorting, column filters and :ref:`facets`. Faceting is controlled separately by the :ref:`setting_allow_facet` setting.
The easiest way to disable arbitrary SQL queries is using the :ref:`default_allow_sql setting <setting_default_allow_sql>` when you first start Datasette running.
You can alternatively use an ``"allow_sql"`` block to control who is allowed to execute arbitrary SQL queries.
@ -1521,6 +1523,8 @@ execute-sql
Actor is allowed to run arbitrary read-only SQL queries against a specific database using the :ref:`custom SQL query page <pages_custom_sql_queries>`, e.g. https://latest.datasette.io/fixtures/-/query?sql=select+100
This action also controls raw SQL supplied using ``?_where=``. It does not control structured table-browsing features such as :ref:`facets`, which use SQL generated by Datasette and are controlled by :ref:`setting_allow_facet`.
``resource`` - ``datasette.resources.DatabaseResource(database)``
``database`` is the name of the database (string)