[api] Fix, related fields need to be explicitly defined

superset/datasets/api.py

@@ -98,6 +98,7 @@ class DatasetRestApi(BaseSupersetModelRestApi):
 
     filter_rel_fields_field = {"owners": "first_name", "database": "database_name"}
     filter_rel_fields = {"database": [["id", DatabaseFilter, lambda: []]]}
+    allowed_rel_fields = {"database"}
 
     @expose("/", methods=["POST"])
     @protect()

superset/views/base_api.py

@@ -16,7 +16,7 @@
 # under the License.
 import functools
 import logging
-from typing import Dict, Tuple
+from typing import Set, Dict, Tuple
 
 from flask import request
 from flask_appbuilder import ModelRestApi
@@ -101,6 +101,7 @@ class BaseSupersetModelRestApi(ModelRestApi):
             "<RELATED_FIELD>": "<FILTER>")
         }
     """  # pylint: disable=pointless-string-statement
+    allowed_rel_fields: Set[str] = set()
 
     def __init__(self):
         super().__init__()
@@ -191,6 +192,8 @@ def related(self, column_name: str, **kwargs):
             500:
               $ref: '#/components/responses/500'
         """
+        if column_name not in self.allowed_rel_fields:
+            return self.response_404()
         args = kwargs.get("rison", {})
         # handle pagination
         page, page_size = self._handle_page_args(args)

superset/views/chart/api.py

@@ -178,4 +178,5 @@ class ChartRestApi(SliceMixin, BaseOwnedModelRestApi):
         "slices": ("slice_name", "asc"),
         "owners": ("first_name", "asc"),
     }
-    filter_rel_fields_field = {"owners": "first_name", "dashboards": "dashboard_title"}
+    filter_rel_fields_field = {"owners": "first_name"}
+    allowed_rel_fields = {"owners"}

superset/views/dashboard/api.py

@@ -173,7 +173,8 @@ class DashboardRestApi(DashboardMixin, BaseOwnedModelRestApi):
         "slices": ("slice_name", "asc"),
         "owners": ("first_name", "asc"),
     }
-    filter_rel_fields_field = {"owners": "first_name", "slices": "slice_name"}
+    filter_rel_fields_field = {"owners": "first_name"}
+    allowed_rel_fields = {"owners"}
 
     @expose("/", methods=["DELETE"])
     @protect()