Skip to content

Fix/saved views ownership idor#2056

Open
shravanithouta108 wants to merge 7 commits into
utksh1:mainfrom
shravanithouta108:fix/saved-views-ownership-idor
Open

Fix/saved views ownership idor#2056
shravanithouta108 wants to merge 7 commits into
utksh1:mainfrom
shravanithouta108:fix/saved-views-ownership-idor

Conversation

@shravanithouta108

Copy link
Copy Markdown
Contributor

Description

saved_views had no shared flag, so there was no way for teams to publish
views without exposing them to IDOR risk. Added a shared boolean column and
migration so owners can publish views team-wide. Non-owners can read shared
views but cannot modify or delete them (returns 403). Private views remain
invisible to other users entirely.

Related Issues

Closes #1879

Type of Change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

  • User A cannot see User B's private views
  • User A cannot modify or delete User B's views (returns 403)
  • Shared views are visible to all users
  • Shared views cannot be modified by non-owners (returns 403)
  • Owner can modify and delete their own views
  • Ran pytest testing/backend -q — all passed

Checklist

  • My code follows the code style of this project.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have made corresponding changes to the documentation.
  • My changes generate no new warnings.

@utksh1 utksh1 added level:advanced 55 pts difficulty label for advanced contributor PRs type:feature Feature work category bonus label type:bug Bug fix work category bonus label area:backend Backend API, database, or service work area:frontend Frontend React/UI work labels Jul 24, 2026

@utksh1 utksh1 left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This combines unrelated AI-summary behavior, Dashboard polling, saved-view sharing/migrations, reporting, and test changes. Please split it into focused PRs per issue and remove unrelated files from each branch; the current backend-unit failure must also be resolved before any portion can merge.

@shravanithouta108
shravanithouta108 force-pushed the fix/saved-views-ownership-idor branch from ba303f2 to b9cee45 Compare July 24, 2026 12:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:backend Backend API, database, or service work area:frontend Frontend React/UI work level:advanced 55 pts difficulty label for advanced contributor PRs type:bug Bug fix work category bonus label type:feature Feature work category bonus label

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[#96] Feature: Add saved-view ownership/tenant scoping and sharing

2 participants