fix(lang): patch FAB's LocaleView to redirect to previous page #31692
Conversation
to redirect to the request referrer instead of relying on the session page_history. This change is needed because most of Superset's page views are handled by the frontend, and as such, not stored in the session page_history.
![korbit-ai[bot]](https://avatars.githubusercontent.com/in/322216?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review by Korbit AI
Korbit automatically attempts to detect when you fix issues in new commits.
| Category | Issue | Fix Detected |
|---|---|---|
 |
Non-descriptive locale error message ▹ view | |
|
Unvalidated redirect from Referer header ▹ view | ✅ |
 |
Insecure Open Redirect ▹ view | ✅ |
Need a new review? Comment
/korbit-reviewon this PR and I'll review your latest changes.Korbit Guide: Usage and Customization
Interacting with Korbit
- You can manually ask Korbit to review your PR using the
/korbit-reviewcommand in a comment at the root of your PR.- You can ask Korbit to generate a new PR description using the
/korbit-generate-pr-descriptioncommand in any comment on your PR.- Too many Korbit comments? I can resolve all my comment threads if you use the
/korbit-resolvecommand in any comment on your PR.- Chat with Korbit on issues we post by tagging @korbit-ai in your reply.
- Help train Korbit to improve your reviews by giving a 👍 or 👎 on the comments Korbit posts.
Customizing Korbit
- Check out our docs on how you can make Korbit work best for you and your team.
- Customize Korbit for your organization through the Korbit Console.
Feedback and Support
| if locale not in self.appbuilder.bm.languages: | ||
| abort(404, description="Locale not supported.") |
There was a problem hiding this comment.
Non-descriptive locale error message 
Tell me more
What is the issue?
The error message when aborting with 404 is too generic and doesn't provide context about which locale was attempted.
Why this matters
When debugging issues with locale changes, administrators won't know which specific locale value caused the failure without checking logs or request parameters.
Suggested change
abort(404, description=f"Locale '{locale}' is not supported. Supported locales: {list(self.appbuilder.bm.languages)}")
Chat with Korbit by mentioning @korbit-ai, and give a 👍 or 👎 to help Korbit improve your reviews.
There was a problem hiding this comment.
Leaving this one up to the reviewers - see original LocaleView
pomegranited
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| redirect_to = request.headers.get("Referer") | ||
| if not redirect_to or not self.is_safe_url(redirect_to): | ||
| redirect_to = self.get_redirect() | ||
| return redirect(redirect_to) |
Check warning
Code scanning / CodeQL
URL redirection from remote source Medium
There was a problem hiding this comment.
Leaving this one up to the reviewers - see original LocaleView
|
Installing the pre-commit hook should resolve at least some of the CI issues. / Alternatively it is possible to run pre-commit by running pre-commit manually: |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #31692 +/- ##
===========================================
+ Coverage 60.48% 83.74% +23.26%
===========================================
Files 1931 538 -1393
Lines 76236 39160 -37076
Branches 8568 0 -8568
===========================================
- Hits 46114 32796 -13318
+ Misses 28017 6364 -21653
+ Partials 2105 0 -2105
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Because we need to be able to change the locale even when logged out, this view cannot be protected.
SUMMARY
Overrides FAB's LocaleView to redirect to the request's referrer instead of relying on the session page history as suggested here.
This isn't a perfect solution, but it keeps the change very close to the actual issue.
Note that this view is marked out in the tests as an "unsecured" view, because we need to be able to change the current locale even when logged out (so that the login page can be presented in the user's preferred language).
Rejected alternatives
update_redirect()whenever a GET view is rendered (like this).This is more in line with how Flask AppBuilder works (and was recommended here).
However, this only works for pages rendered by Superset's backend, and most Superset pages are rendered by the frontend.
LOG_ACTIONS_SPA_NAVIGATIONevent is logged to the backend.This approach felt even hackier than the one posted here, and farther from the issue it addresses.
Also, Flask AppBuilder only provides the
update_redirect()method which uses the currentrequest.url, so we'd need to add another method that could use a differenturl.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Before:
Untitled.video.-.Made.with.Clipchamp.12.mp4
After:
Language.redirect.-.Made.with.Clipchamp.mp4
TESTING INSTRUCTIONS
ADDITIONAL INFORMATION