explorerhq / explorerhq/sql-explorer

Use of Django connection name rather than alias as lookup

Open
#456 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.9k
Forks
373
PR merge metrics
No merged PRs in 30d

Description

While looking through the connection logic for my attempt to address #455, I noticed that the name used to get a connection is the django connection name rather than the alias. The implications of this are:
- security
- if you know a django connection name you can access it even if explorer is not mapped to allow access to it, since `EXPLORER_CONNECTIONS` is only used to build the intended connections, not to sanity check the provided one
- usability
- you cannot cahnge the targeted django connection of a stored `Query`
- if you realize that you want to create a new connection with different credentials, only new `Query` instances will store that connection and all old ones continue using the existing one
- if you need to rename a django connection, all existing `Query` instances will be broken

It would be better if the stored connection was the explorer's name rather than the django name, so that remapping is possible and `EXPLORER_CONNECTIONS` can be used to gate access to the defined database connections.

If this change in behavior is acceptable, I could prepare a PR to implement it, including a migration that re-writes the stored `Query.connection` values.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.