carfeii fccdd29421 Add per-user ownership check to dashboard load/update/delete ...

Dashboard resource endpoints (load_resource, update_resource,
update_canvas, delete_resource) fetched a core_dashboard row by id
alone, with no check that the caller created it. The only gating
decorator verified workspace membership, not per-user ownership, so
any authenticated workspace member could read, rename, or delete any
other member's dashboard by id. list_resource already filters by
create_by, showing dashboards are meant to be private per creator;
this adds the same check to the other four code paths.

2026-09-17 10:21:18 +08:00

..

__init__.py

feat: dashboard preview

2025-06-03 18:36:01 +08:00

dashboard_api.py

Add per-user ownership check to dashboard load/update/delete

2026-09-17 10:21:18 +08:00