fix: add missing ownership checks to tag, report-log, and dataset-schema endpoints - #43390

Open

rusackas wants to merge 12 commits into

fix/tag-report-log-dataset-schema-checks

Commits on Aug 21, 2026

fix(tags): check per-object access before deleting tag associations
Superset Dev
committed
599697b
fix(tags): require ownership before bulk-deleting tags by name
Superset Dev
committed
6ee4820
fix(security): make user-registrations API admin-only and read-only
Superset Dev
committed
13af5cc
fix(reports): scope execution-log API reads to editable schedules
Superset Dev
committed
816b98f
fix(datasets): drop email from drill_info's nested user schema
Superset Dev
committed
c91505e
fix(tags): call self.logout() between user switches in delete-tags test

Superset Dev
and
claude
committed
345d7c3
docs(tags): trim a test docstring
Superset Dev
committed
0dbd0df
fix(tags): route single-tag DELETE through DeleteTagsCommand

Superset Dev
and
claude
committed
d0861c3
fix(reports): gate execution-log unrestricted read on can_access_all_queries

Superset Dev
and
claude
committed
0ceacde
fix(security): restore DELETE on the user-registrations API

Superset Dev
and
claude
committed
bf4a781
fix(datasets): drop secondary_label from drill_info's editors field

Superset Dev
and
claude
committed
b8ffd8d
fix(tags): make DeleteTagsCommand's composited exceptions ValidationError subclasses

Superset Dev
and
claude
committed
9da5553