remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-24 19:04:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

Limit derived-table permissions to one source hop

Browse source 
Simplify the solution to 5de0c1724e - avoid contextvar.
This commit is contained in:
Simon Willison 2026-09-10 15:46:12 -07:00
commit 92c7d4b608
9 changed files with 235 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/test_html.py
View file

@ -36,8 +36,10 @@ def test_homepage(app_client_two_attached_databases):
h2 = soup.select("h2")[0]
assert "extra database" == h2.text.strip()
counts_p, links_p = h2.find_all_next("p")[:2]
# Shadow tables of the external-content index are denied, so they do not
# contribute to the table or row totals.
assert (
"2 rows in 1 table, 5 rows in 4 hidden tables, 1 view" == counts_p.text.strip()
"2 rows in 1 table, 2 rows in 1 hidden table, 1 view" == counts_p.text.strip()
)
# We should only show visible, not hidden tables here:
table_links = [