fix(dao): use explicit id filter (#23246)

superset/dao/base.py

@@ -65,9 +65,9 @@ class BaseDAO:
             query = cls.base_filter(  # pylint: disable=not-callable
                 cls.id_column_name, data_model
             ).apply(query, None)
-        id_filter = {cls.id_column_name: model_id}
+        id_column = getattr(cls.model_cls, cls.id_column_name)
         try:
-            return query.filter_by(**id_filter).one_or_none()
+            return query.filter(id_column == model_id).one_or_none()
         except StatementError:
             # can happen if int is passed instead of a string or similar
             return None

tests/integration_tests/charts/api_tests.py

@@ -609,17 +609,21 @@ class TestChartApi(SupersetTestCase, ApiOwnersTestCaseMixin, InsertChartMixin):
         """
         Chart API: Test update set new owner implicitly adds logged in owner
         """
-        gamma = self.get_user("gamma")
+        gamma = self.get_user("gamma_no_csv")
         alpha = self.get_user("alpha")
-        chart_id = self.insert_chart("title", [alpha.id], 1).id
-        chart_data = {"slice_name": "title1_changed", "owners": [gamma.id]}
-        self.login(username="alpha")
+        chart_id = self.insert_chart("title", [gamma.id], 1).id
+        chart_data = {
+            "slice_name": (new_name := "title1_changed"),
+            "owners": [alpha.id],
+        }
+        self.login(username=gamma.username)
         uri = f"api/v1/chart/{chart_id}"
         rv = self.put_assert_metric(uri, chart_data, "put")
-        self.assertEqual(rv.status_code, 200)
+        assert rv.status_code == 200
         model = db.session.query(Slice).get(chart_id)
-        self.assertIn(alpha, model.owners)
-        self.assertIn(gamma, model.owners)
+        assert model.slice_name == new_name
+        assert alpha in model.owners
+        assert gamma in model.owners
         db.session.delete(model)
         db.session.commit()