explorerhq / explorerhq/sql-explorer
Use of Django connection name rather than alias as lookup
- Dominant language
- Python
- Stars
- 2.9k
- Forks
- 373
- PR merge metrics
- No merged PRs in 30d
Description
While looking through the connection logic for my attempt to address #455, I noticed that the name used to get a connection is the django connection name rather than the alias. The implications of this are:
- security
- if you know a django connection name you can access it even if explorer is not mapped to allow access to it, since `EXPLORER_CONNECTIONS` is only used to build the intended connections, not to sanity check the provided one
- usability
- you cannot cahnge the targeted django connection of a stored `Query`
- if you realize that you want to create a new connection with different credentials, only new `Query` instances will store that connection and all old ones continue using the existing one
- if you need to rename a django connection, all existing `Query` instances will be broken
It would be better if the stored connection was the explorer's name rather than the django name, so that remapping is possible and `EXPLORER_CONNECTIONS` can be used to gate access to the defined database connections.
If this change in behavior is acceptable, I could prepare a PR to implement it, including a migration that re-writes the stored `Query.connection` values.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.