fix: missing user permission validation for related views

flask_appbuilder/baseviews.py

@@ -679,6 +679,8 @@ class MyView(ModelView):
     """
     _related_views = None
     """ internal list with ref to instantiated view classes """
+    allowed_related_views = None
+    """ Holds related views where the user has 'can_list' permission. """
     list_title = ""
     """ List Title, if not configured the default is 'List ' with pretty model name """
     show_title = ""
@@ -1032,8 +1034,15 @@ def _get_related_views_widgets(
             Model View widgets
         """
         widgets = widgets or {}
+        self.allowed_related_views = []
         widgets["related_views"] = []
         for view in self._related_views:
+            # Skip related views if the current user does not have 'can_list' permission
+            if not self.appbuilder.sm.has_access("can_list", view.__class__.__name__):
+                continue
+
+            self.allowed_related_views.append(view)
+
             if orders.get(view.__class__.__name__):
                 order_column, order_direction = orders.get(view.__class__.__name__)
             else:

flask_appbuilder/templates/appbuilder/general/model/edit.html

@@ -13,9 +13,12 @@
         </ul>
 
         <div class="tab-content">
+        {% set widget_related_views = widgets.get('related_views') %}
         {% for view in related_views %}
         <div id="{{view.__class__.__name__}}" class="tab-pane">
-        {{ widgets.get('related_views')[loop.index - 1]()|safe }}
+        {% if loop.index0 < widget_related_views|length %}
+            {{ widget_related_views[loop.index0](pk=pk)|safe }}
+        {% endif %}
     </div>
     {% endfor %}
 {% endif %}

flask_appbuilder/templates/appbuilder/general/model/edit_cascade.html

@@ -11,9 +11,12 @@
 
 {% block related_views %}
     {% if related_views is defined %}
+        {% set widget_related_views = widgets.get('related_views') %}
         {% for view in related_views %}
             {% call lib.accordion_tag(view.__class__.__name__,view.title, False) %}
-                {{ widgets.get('related_views')[loop.index - 1](pk = pk)|safe }}
+                {% if loop.index0 < widget_related_views|length %}
+                    {{ widget_related_views[loop.index0](pk=pk)|safe }}
+                {% endif %}
             {% endcall %} 
         {% endfor %}
     {% endif %}

flask_appbuilder/templates/appbuilder/general/model/left_master_detail.html

@@ -8,11 +8,14 @@
    	        {{ widgets.get('list')()|safe }}
     {{ lib.panel_end() }}
 </div>
+{% set widget_related_views = widgets.get('related_views') %}
 {% for view in related_views %}
     <div class="col-lg-{{ 12 - master_div_width}} col-md-{{ 12 - master_div_width}} container">
         {{ lib.panel_begin(view.list_title) }}
         <div>
-            {{ widgets.get('related_views')[loop.index - 1](pk = pk)|safe }}
+            {% if loop.index0 < widget_related_views|length %}
+                {{ widget_related_views[loop.index0](pk=pk)|safe }}
+            {% endif %}
         </div>
         {{ lib.panel_end() }}
     </div>

flask_appbuilder/templates/appbuilder/general/model/show.html

@@ -8,16 +8,22 @@
     <ul class="nav nav-tabs"  style="{{"display: none;" if not related_views else "" }}">
     <li class="active"><a href="#Home" data-toggle="tab">{{ _("Detail") }}</a> </li>
         {% for view in related_views %}
-            <li>
-                <a href="#{{view.__class__.__name__}}" data-toggle="tab">{{view.title}}</a>
-            </li>
+            {% set can_list = "can_list" | is_item_visible(view.__class__.__name__) %}
+            {% if can_list %}
+                <li>
+                    <a href="#{{view.__class__.__name__}}" data-toggle="tab">{{view.title}}</a>
+                </li>
+            {% endif %}
         {% endfor %}
     </ul>
 
     <div class="tab-content">
+    {% set widget_related_views = widgets.get('related_views') %}
     {% for view in related_views %}
         <div id="{{view.__class__.__name__}}" class="tab-pane">
-            {{ widgets.get('related_views')[loop.index - 1](pk = pk)|safe }}
+            {% if loop.index0 < widget_related_views|length %}
+                {{ widget_related_views[loop.index0](pk=pk)|safe }}
+            {% endif %}
         </div>
     {% endfor %}
 {% endif %}

flask_appbuilder/templates/appbuilder/general/model/show_cascade.html

@@ -10,9 +10,12 @@
 
 {% block related_views %}
     {% if related_views is defined %}
+        {% set widget_related_views = widgets.get('related_views') %}
         {% for view in related_views %}
             {% call lib.accordion_tag(view.__class__.__name__,view.title, False) %}
-                {{ widgets.get('related_views')[loop.index - 1](pk = pk)|safe }}
+                {% if loop.index0 < widget_related_views|length %}
+                    {{ widget_related_views[loop.index0](pk=pk)|safe }}
+                {% endif %}
             {% endcall %}
         {% endfor %}
     {% endif %}

flask_appbuilder/views.py

@@ -571,7 +571,7 @@ def show(self, pk):
             pk=pk,
             title=self.show_title,
             widgets=widgets,
-            related_views=self._related_views,
+            related_views=self.allowed_related_views,
         )
 
     """
@@ -609,7 +609,7 @@ def edit(self, pk):
                 self.edit_template,
                 title=self.edit_title,
                 widgets=widgets,
-                related_views=self._related_views,
+                related_views=self.allowed_related_views,
             )
 
     """
@@ -731,7 +731,7 @@ def list(self, pk=None):
             widgets = self._get_related_views_widgets(
                 item, orders=orders, pages=pages, page_sizes=page_sizes, widgets=widgets
             )
-            related_views = self._related_views
+            related_views = self.allowed_related_views
         else:
             related_views = []