fix: db validate parameters permission (#24185)

apache · Jun 6, 2023 · 2a74a3a · 2a74a3a
1 parent 9adadc6
commit 2a74a3a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/UPDATING.md b/UPDATING.md
@@ -23,6 +23,7 @@ This file documents any backwards-incompatible changes in Superset and
 assists people when migrating to a new version.
 
 ## 2.1.1
+- [24185](https://github.com/apache/superset/pull/24185): `/api/v1/database/test_connection` and `api/v1/database/validate_parameters` permissions changed from `can_read` to `can_write`. Only Admin user's have access.
 
 ### Other
 

diff --git a/superset/constants.py b/superset/constants.py
@@ -125,8 +125,8 @@ class RouteMethod:  # pylint: disable=too-few-public-methods
     "select_star": "read",
     "table_metadata": "read",
     "table_extra_metadata": "read",
-    "test_connection": "read",
-    "validate_parameters": "read",
+    "test_connection": "write",
+    "validate_parameters": "write",
     "favorite_status": "read",
     "thumbnail": "read",
     "import_": "write",