From 82a9d25e9226e331c8aec0c34208c803d8e407a7 Mon Sep 17 00:00:00 2001
From: John Bodley <4567245+john-bodley@users.noreply.github.com>
Date: Wed, 23 May 2018 11:40:25 -0700
Subject: [PATCH 1/2] [cherry-picks] Picking cherries

---
 superset/models/core.py |  8 ++++++--
 tests/model_tests.py    | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/superset/models/core.py b/superset/models/core.py
index 4599ad279e92a..6fe6d253940ba 100644
--- a/superset/models/core.py
+++ b/superset/models/core.py
@@ -691,9 +691,13 @@ def get_quoter(self):
         return self.get_dialect().identifier_preparer.quote
 
     def get_df(self, sql, schema):
-        sql = sql.strip().strip(';')
+        sqls = [x.strip() for x in sql.strip().strip(';').split(';')]
         eng = self.get_sqla_engine(schema=schema)
-        df = pd.read_sql(sql, eng)
+
+        for i in range(len(sqls) - 1):
+            eng.execute(sqls[i])
+
+        df = pd.read_sql_query(sqls[-1], eng)
 
         def needs_conversion(df_series):
             if df_series.empty:
diff --git a/tests/model_tests.py b/tests/model_tests.py
index 0b4a16bd450b9..a6bd109ef6a66 100644
--- a/tests/model_tests.py
+++ b/tests/model_tests.py
@@ -73,3 +73,17 @@ def test_database_impersonate_user(self):
         model.impersonate_user = False
         user_name = make_url(model.get_sqla_engine(user_name=example_user).url).username
         self.assertNotEquals(example_user, user_name)
+
+    def test_single_statement(self):
+        main_db = self.get_main_database(db.session)
+
+        if main_db.backend == 'mysql':
+            df = main_db.get_df('SELECT 1', None)
+            self.assertEquals(df.iat[0, 0], 1)
+
+    def test_multi_statement(self):
+        main_db = self.get_main_database(db.session)
+
+        if main_db.backend == 'mysql':
+            df = main_db.get_df('USE superset; SELECT 1', None)
+            self.assertEquals(df.iat[0, 0], 1)

From 03c39189e4373ad5f5fd279965fb6dee61f64329 Mon Sep 17 00:00:00 2001
From: John Bodley <4567245+john-bodley@users.noreply.github.com>
Date: Wed, 23 May 2018 13:30:02 -0700
Subject: [PATCH 2/2] [markup] Enable allow-forms (#5062)

(cherry picked from commit d322e48c57171d93aa21265303a9c6237ba687c6)
---
 superset/assets/visualizations/markup.js | 2 +-
 tests/model_tests.py                     | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/superset/assets/visualizations/markup.js b/superset/assets/visualizations/markup.js
index 193eb4d65f177..ee8dce68bd3eb 100644
--- a/superset/assets/visualizations/markup.js
+++ b/superset/assets/visualizations/markup.js
@@ -30,7 +30,7 @@ function markupWidget(slice, payload) {
     <iframe id="${iframeId}"
       frameborder="0"
       height="${iframeHeight}"
-      sandbox="allow-same-origin allow-scripts allow-top-navigation allow-popups">
+      sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation">
     </iframe>
   `);
 
diff --git a/tests/model_tests.py b/tests/model_tests.py
index a6bd109ef6a66..f25319556ea32 100644
--- a/tests/model_tests.py
+++ b/tests/model_tests.py
@@ -4,14 +4,14 @@
 from __future__ import print_function
 from __future__ import unicode_literals
 
-import unittest
-
 from sqlalchemy.engine.url import make_url
 
+from superset import db
 from superset.models.core import Database
+from .base_tests import SupersetTestCase
 
 
-class DatabaseModelTestCase(unittest.TestCase):
+class DatabaseModelTestCase(SupersetTestCase):
 
     def test_database_schema_presto(self):
         sqlalchemy_uri = 'presto://presto.airbnb.io:8080/hive/default'