remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-10-07 09:57:03 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add arbitrary write SQL execution page

Browse source 
Refs #2735
This commit is contained in:
Simon Willison 2026-05-25 08:30:49 -07:00
commit ef43c10388
8 changed files with 487 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/authentication.rst
View file

@ -1423,13 +1423,23 @@ Actor is allowed to drop a database table.
execute-sql
-----------
Actor is allowed to run arbitrary SQL queries against a specific database, e.g. https://latest.datasette.io/fixtures/-/query?sql=select+100
Actor is allowed to run arbitrary read-only SQL queries against a specific database, e.g. https://latest.datasette.io/fixtures/-/query?sql=select+100
``resource`` - ``datasette.resources.DatabaseResource(database)``
``database`` is the name of the database (string)
See also :ref:`the default_allow_sql setting <setting_default_allow_sql>`.
.. _actions_execute_write_sql:
execute-write-sql
-----------------
Actor is allowed to run arbitrary writable SQL queries against a specific database, subject to table-level write permissions such as ``insert-row``, ``update-row`` and ``delete-row``.
``resource`` - ``datasette.resources.DatabaseResource(database)``
``database`` is the name of the database (string)
.. _actions_permissions_debug:
permissions-debug

9
docs/json_api.rst
View file

@ -526,6 +526,15 @@ Creating saved queries
``POST /<database>/-/queries/-/insert`` creates a saved query. This requires ``execute-sql`` and ``insert-query`` for the database.
.. _ExecuteWriteView:
Executing write SQL
~~~~~~~~~~~~~~~~~~~
``GET /<database>/-/execute-write`` displays a form for executing writable SQL. A ``?sql=`` query string pre-populates the form without executing it.
``POST /<database>/-/execute-write`` executes writable SQL. This requires ``execute-write-sql`` for the database plus the relevant table-level write permissions.
.. _QueryDefinitionView:
Getting a saved query definition