Merge branch 'master' into pillow-version

docs/security.rst

@@ -1,6 +1,12 @@
 Security
 ========
 
+Responsible disclosure
+----------------------
+
+We want to keep Flask-AppBuilder safe for everyone. If you've discovered a security vulnerability
+please report to [email protected].
+
 Supported Authentication Types
 ------------------------------
 

examples/factoryapp/README.rst

@@ -9,7 +9,7 @@ Create an Admin user and insert test data::
 
 Run it::
 
-    $ export FLASK_APP="app:create_app('config')"
+    $ export FLASK_APP="app.app:create_app('config')"
     $ flask fab create-admin
     $ flask run
 

examples/factoryapp/app/__init__.py

@@ -1,24 +0,0 @@
-import logging
-
-from flask import Flask
-from flask_appbuilder import AppBuilder, SQLA
-
-logging.basicConfig(format="%(asctime)s:%(levelname)s:%(name)s:%(message)s")
-logging.getLogger().setLevel(logging.DEBUG)
-
-db = SQLA()
-appbuilder = AppBuilder()
-
-
-def create_app(config):
-    app = Flask(__name__)
-    with app.app_context():
-        app.config.from_object(config)
-        db.init_app(app)
-        appbuilder.init_app(app, db.session)
-        from . import views  # noqa
-
-        db.create_all()
-        appbuilder.post_init()
-        views.fill_gender()
-    return app

examples/factoryapp/app/app.py

@@ -0,0 +1,36 @@
+import logging
+
+from flask import Flask
+from flask_appbuilder import AppBuilder, SQLA
+
+logging.basicConfig(format="%(asctime)s:%(levelname)s:%(name)s:%(message)s")
+logging.getLogger().setLevel(logging.DEBUG)
+
+
+def create_app(config):
+    app = Flask(__name__)
+    db = SQLA()
+    appbuilder = AppBuilder()
+    with app.app_context():
+        app.config.from_object(config)
+        db.init_app(app)
+        appbuilder.init_app(app, db.session)
+
+        from .views import ContactModelView, GroupModelView, fill_gender
+
+        appbuilder.add_view(
+            ContactModelView,
+            "List Contacts",
+            icon="fa-envelope",
+            category="Contacts",
+            category_icon="fa-envelope",
+        )
+
+        appbuilder.add_view(
+            GroupModelView, "List Groups", icon="fa-folder-open-o", category="Contacts"
+        )
+
+        db.create_all()
+        appbuilder.post_init()
+        fill_gender()
+    return app

examples/factoryapp/app/views.py

@@ -1,17 +1,17 @@
-from flask_appbuilder import ModelView
+from flask import current_app
+from flask_appbuilder import ModelView, IndexView
 from flask_appbuilder.models.sqla.interface import SQLAInterface
 
-from . import appbuilder, db
 from .models import Contact, ContactGroup, Gender
 
 
 def fill_gender():
     try:
-        db.session.add(Gender(name="Male"))
-        db.session.add(Gender(name="Female"))
-        db.session.commit()
+        current_app.appbuilder.session.add(Gender(name="Male"))
+        current_app.appbuilder.session.add(Gender(name="Female"))
+        current_app.appbuilder.session.commit()
     except Exception:
-        db.session.rollback()
+        current_app.appbuilder.session.rollback()
 
 
 class ContactModelView(ModelView):
@@ -71,20 +71,10 @@ class ContactModelView(ModelView):
     ]
 
 
-appbuilder.add_view(
-    ContactModelView,
-    "List Contacts",
-    icon="fa-envelope",
-    category="Contacts",
-    category_icon="fa-envelope",
-)
-
-
 class GroupModelView(ModelView):
     datamodel = SQLAInterface(ContactGroup)
     related_views = [ContactModelView]
 
 
-appbuilder.add_view(
-    GroupModelView, "List Groups", icon="fa-folder-open-o", category="Contacts"
-)
+class MyIndexView(IndexView):
+    index_template = "my_index.html"

examples/factoryapp/config.py

@@ -18,6 +18,8 @@
 # SQLALCHEMY_DATABASE_URI = 'postgresql://scott:tiger@localhost:5432/myapp'
 # SQLALCHEMY_ECHO = True
 
+FAB_INDEX_VIEW = "app.views.MyIndexView"
+
 BABEL_DEFAULT_LOCALE = "en"
 BABEL_DEFAULT_FOLDER = "translations"
 LANGUAGES = {

examples/factoryapp/testdata.py

@@ -1,7 +1,8 @@
 from datetime import datetime
 import random
 
-from app import create_app, db
+from flask import current_app
+from app.app import create_app
 from app.models import Contact, ContactGroup, Gender
 
 app = create_app("config")
@@ -17,19 +18,19 @@ def get_random_name(names_list, size=1):
 
 
 try:
-    db.session.add(ContactGroup(name="Friends"))
-    db.session.add(ContactGroup(name="Family"))
-    db.session.add(ContactGroup(name="Work"))
-    db.session.commit()
+    current_app.appbuilder.session.add(ContactGroup(name="Friends"))
+    current_app.appbuilder.session.add(ContactGroup(name="Family"))
+    current_app.appbuilder.session.add(ContactGroup(name="Work"))
+    current_app.appbuilder.session.commit()
 except Exception:
-    db.session.rollback()
+    current_app.appbuilder.session.rollback()
 
 try:
-    db.session.add(Gender(name="Male"))
-    db.session.add(Gender(name="Female"))
-    db.session.commit()
+    current_app.appbuilder.session.add(Gender(name="Male"))
+    current_app.appbuilder.session.add(Gender(name="Female"))
+    current_app.appbuilder.session.commit()
 except Exception:
-    db.session.rollback()
+    current_app.appbuilder.session.rollback()
 
 f = open("NAMES.DIC", "rb")
 names_list = [x.strip() for x in f.readlines()]
@@ -50,9 +51,9 @@ def get_random_name(names_list, size=1):
     month = random.choice(range(1, 12))
     day = random.choice(range(1, 28))
     c.birthday = datetime(year, month, day)
-    db.session.add(c)
+    current_app.appbuilder.session.add(c)
     try:
-        db.session.commit()
+        current_app.appbuilder.session.commit()
         print("inserted {0}".format(c))
     except Exception:
-        db.session.rollback()
+        current_app.appbuilder.session.rollback()

flask_appbuilder/api/__init__.py

@@ -533,7 +533,10 @@ def add_api_spec(self, api_spec: APISpec) -> None:
 
     def add_apispec_components(self, api_spec: APISpec) -> None:
         for k, v in self.responses.items():
-            api_spec.components._responses[k] = v
+            try:
+                api_spec.components.response(k, v)
+            except DuplicateComponentNameError:
+                pass
         for k, v in self._apispec_parameter_schemas.items():
             try:
                 api_spec.components.schema(k, v)

flask_appbuilder/base.py

@@ -30,7 +30,11 @@
 
 
 DynamicImportType = Union[
-    Type["BaseManager"], Type["BaseView"], Type["BaseSecurityManager"], Type[Menu]
+    Type["BaseManager"],
+    Type["BaseView"],
+    Type["BaseSecurityManager"],
+    Type[Menu],
+    Type["AbstractViewApi"],
 ]
 
 
@@ -93,7 +97,7 @@ def __init__(
         app: Optional[Flask] = None,
         session: Optional[SessionBase] = None,
         menu: Optional[Menu] = None,
-        indexview: Optional["AbstractViewApi"] = None,
+        indexview: Optional[Type["AbstractViewApi"]] = None,
         base_template: str = "appbuilder/baselayout.html",
         static_folder: str = "static/appbuilder",
         static_url_path: str = "/appbuilder",
@@ -121,7 +125,7 @@ def __init__(
             optional, update permissions flag (Boolean) you can use
             FAB_UPDATE_PERMS config key also
         """
-        self.baseviews: List["AbstractViewApi"] = []
+        self.baseviews: List[Union[Type["AbstractViewApi"], "AbstractViewApi"]] = []
 
         # temporary list that hold addon_managers config key
         self._addon_managers: List[str] = []
@@ -172,12 +176,11 @@ def init_app(self, app: Flask, session: SessionBase) -> None:
             "FAB_STATIC_URL_PATH", self.static_url_path
         )
         _index_view = app.config.get("FAB_INDEX_VIEW", None)
-        if _index_view is not None:
-            view = dynamic_class_import(_index_view)
-            if isinstance(view, BaseView):
-                self.indexview = view
+        if _index_view:
+            self.indexview = dynamic_class_import(_index_view)  # type: ignore
         else:
-            self.indexview = self.indexview or IndexView()
+            self.indexview = self.indexview or IndexView
+
         _menu = app.config.get("FAB_MENU", None)
 
         # Setup Menu
@@ -229,7 +232,7 @@ def _init_extension(self, app: Flask) -> None:
     def post_init(self) -> None:
         for baseview in self.baseviews:
             # instantiate the views and add session
-            self._check_and_init(baseview)
+            baseview = self._check_and_init(baseview)
             # Register the views has blueprints
             if baseview.__class__.__name__ not in self.get_app.blueprints.keys():
                 self.register_blueprint(baseview)
@@ -313,12 +316,11 @@ def _add_global_static(self) -> None:
 
     def _add_admin_views(self) -> None:
         """
-            Registers indexview, utilview (back function), babel views and Security views.
+        Registers indexview, utilview (back function), babel views and Security views.
         """
         if self.indexview:
-            self.indexview = self._check_and_init(self.indexview)
-            self.add_view_no_menu(self.indexview)
-        self.add_view_no_menu(UtilView())
+            self._indexview = self.add_view_no_menu(self.indexview)
+        self.add_view_no_menu(UtilView)
         self.bm.register_views()
         self.sm.register_views()
         self.openapi_manager.register_views()
@@ -344,7 +346,9 @@ def _add_addon_views(self) -> None:
                     log.exception(e)
                     log.error(LOGMSG_ERR_FAB_ADDON_PROCESS.format(addon, e))
 
-    def _check_and_init(self, baseview: "AbstractViewApi") -> "AbstractViewApi":
+    def _check_and_init(
+        self, baseview: Union[Type["AbstractViewApi"], "AbstractViewApi"]
+    ) -> "AbstractViewApi":
         # If class if not instantiated, instantiate it
         # and add db session from security models.
         if hasattr(baseview, "datamodel"):
@@ -356,7 +360,7 @@ def _check_and_init(self, baseview: "AbstractViewApi") -> "AbstractViewApi":
 
     def add_view(
         self,
-        baseview: "AbstractViewApi",
+        baseview: Union[Type["AbstractViewApi"], "AbstractViewApi"],
         name: str,
         href: str = "",
         icon: str = "",
@@ -536,7 +540,7 @@ def add_separator(
 
     def add_view_no_menu(
         self,
-        baseview: "AbstractViewApi",
+        baseview: Union[Type["AbstractViewApi"], "AbstractViewApi"],
         endpoint: Optional[str] = None,
         static_folder: Optional[str] = None,
     ) -> "AbstractViewApi":
@@ -565,7 +569,7 @@ def add_view_no_menu(
             log.warning(LOGMSG_WAR_FAB_VIEW_EXISTS.format(baseview.__class__.__name__))
         return baseview
 
-    def add_api(self, baseview: "AbstractViewApi") -> "AbstractViewApi":
+    def add_api(self, baseview: Type["AbstractViewApi"]) -> "AbstractViewApi":
         """
         Add a BaseApi class or child to AppBuilder
 
@@ -621,9 +625,11 @@ def get_url_for_logout(self) -> str:
 
     @property
     def get_url_for_index(self) -> str:
-        if self.indexview is None:
+        if self._indexview is None:
             return ""
-        return url_for("%s.%s" % (self.indexview.endpoint, self.indexview.default_view))
+        return url_for(
+            "%s.%s" % (self._indexview.endpoint, self._indexview.default_view)
+        )
 
     @property
     def get_url_for_userinfo(self) -> str:
@@ -640,8 +646,11 @@ def get_url_for_locale(self, lang: str) -> str:
         )
 
     def add_permissions(self, update_perms: bool = False) -> None:
+        from flask_appbuilder.baseviews import AbstractViewApi
+
         if self.update_perms or update_perms:
             for baseview in self.baseviews:
+                baseview = cast(AbstractViewApi, baseview)
                 self._add_permission(baseview, update_perms=update_perms)
             self._add_menu_permissions(update_perms=update_perms)
 
@@ -695,7 +704,10 @@ def _view_exists(self, view: "AbstractViewApi") -> bool:
         return False
 
     def _process_inner_views(self) -> None:
+        from flask_appbuilder.baseviews import AbstractViewApi
+
         for view in self.baseviews:
+            view = cast(AbstractViewApi, view)
             for inner_class in view.get_uninit_inner_views():
                 for v in self.baseviews:
                     if (

flask_appbuilder/security/sqla/manager.py

@@ -573,7 +573,7 @@ def add_permission_view_menu(self, permission_name, view_menu_name):
         vm = self.add_view_menu(view_menu_name)
         perm = self.add_permission(permission_name)
         pv = self.permissionview_model()
-        pv.view_menu_id, pv.permission_id = vm.id, perm.id
+        pv.view_menu, pv.permission = vm, perm
         try:
             self.get_session.add(pv)
             self.get_session.commit()