Make explicitly-set REDASH_DISABLE_PUBLIC_URLS win over stored org settings

disable_public_urls is not editable in the admin UI, but the General
Settings form posts back every value it received from
GET /api/settings/organization, so the env-derived value gets persisted
into organizations.settings. From then on the stored copy shadowed the
environment variable, and flipping REDASH_DISABLE_PUBLIC_URLS had no
effect.

Give the environment variable precedence in Organization.get_setting(),
but only when it is explicitly present in the environment. When the
variable is unset, stored values keep working exactly as before, so API
consumers that toggle the setting at runtime (e.g. the Cypress sharing
specs) are unaffected, and the settings endpoint's persistence and audit
behavior is unchanged.

Fixes #7630

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ekanshul

redash/models/organizations.py

@@ -2,6 +2,7 @@
 from sqlalchemy.orm.attributes import flag_modified
 from sqlalchemy_utils.models import generic_repr
 
+from redash.settings.organization import env_overrides as org_settings_env_overrides
 from redash.settings.organization import settings as org_settings
 
 from .base import Column, db, primary_key
@@ -66,7 +67,7 @@ def set_setting(self, key, value):
         flag_modified(self, "settings")
 
     def get_setting(self, key, raise_on_missing=True):
-        if key in self.settings.get("settings", {}):
+        if key in self.settings.get("settings", {}) and key not in org_settings_env_overrides:
             return self.settings["settings"][key]
 
         if key in org_settings:

redash/settings/organization.py

@@ -81,3 +81,13 @@
     "hide_plotly_mode_bar": HIDE_PLOTLY_MODE_BAR,
     "disable_public_urls": DISABLE_PUBLIC_URLS,
 }
+
+# Settings whose environment variable, when explicitly set, takes precedence over
+# a value stored in the organizations table. disable_public_urls is not editable
+# from the admin UI, but the admin settings form posts back every setting it
+# receives, so an env-derived value can end up persisted in the database; without
+# this override, that stored copy would silently shadow the environment variable
+# forever (#7630). When the environment variable is not set, the stored value
+# keeps working as before.
+_ENV_OVERRIDABLE = {"disable_public_urls": "REDASH_DISABLE_PUBLIC_URLS"}
+env_overrides = frozenset(key for key, var in _ENV_OVERRIDABLE.items() if var in os.environ)

tests/handlers/test_settings.py

@@ -1,8 +1,34 @@
+from unittest import mock
+
 from redash.models import Organization
 from tests import BaseTestCase
 
 
 class TestOrganizationSettings(BaseTestCase):
+    def test_env_override_wins_over_stored_value(self):
+        # When REDASH_DISABLE_PUBLIC_URLS is explicitly set, a value persisted
+        # into the organizations table by an older version must not shadow it (#7630).
+        self.factory.org.settings["settings"] = {"disable_public_urls": True}
+
+        with mock.patch(
+            "redash.models.organizations.org_settings_env_overrides",
+            frozenset(["disable_public_urls"]),
+        ):
+            self.assertEqual(self.factory.org.get_setting("disable_public_urls"), False)
+
+    def test_stored_value_applies_without_env_override(self):
+        # Without the environment variable set, the stored value keeps working
+        # (e.g. the Cypress sharing specs toggle it through the API).
+        admin = self.factory.create_admin()
+        rv = self.make_request(
+            "post",
+            "/api/settings/organization",
+            data={"disable_public_urls": True},
+            user=admin,
+        )
+        self.assertEqual(rv.status_code, 200)
+        self.assertEqual(self.factory.org.get_setting("disable_public_urls"), True)
+
     def test_post(self):
         admin = self.factory.create_admin()
         rv = self.make_request(