Add missing permissions to varimport (apache#17468)

(cherry picked from commit eb6af07)
(cherry picked from commit 2bbaec8)

airflow/www/views.py

@@ -3104,7 +3104,6 @@ class VariableModelView(AirflowModelView):
         'delete': 'delete',
         'action_muldelete': 'delete',
         'action_varexport': 'read',
-        'varimport': 'create',
     }
     base_permissions = [
         permissions.ACTION_CAN_CREATE,
@@ -3167,6 +3166,7 @@ def action_varexport(self, items):
         return response
 
     @expose('/varimport', methods=["POST"])
+    @auth.has_access([(permissions.ACTION_CAN_CREATE, permissions.RESOURCE_VARIABLE)])
     @action_logging
     def varimport(self):
         """Import variables"""

tests/www/test_views.py

@@ -333,6 +333,19 @@ def test_import_variables_success(self):
         )
         self.check_content_in_response('4 variable(s) successfully updated.', resp)
 
+    def test_import_variables_anon(self):
+        assert self.session.query(models.Variable).count() == 0
+
+        content = '{"str_key": "str_value}'
+        bytes_content = io.BytesIO(bytes(content, encoding='utf-8'))
+
+        self.logout()
+        resp = self.client.post(
+            '/variable/varimport', data={'file': (bytes_content, 'test.json')}, follow_redirects=True
+        )
+        self.check_content_not_in_response('variable(s) successfully updated.', resp)
+        self.check_content_in_response('Sign In', resp)
+
 
 class PluginOperator(BaseOperator):
     pass