Dashboard refresh query result needs view_query permission

[loskultos]

Issue Summary

Dashboard widgets refresh functionality only works when the user has view_query permission. view_query permission allows the user to see the query source

Expected Behavior

When the user has execute_query permission the refresh in the dashboard widgets should work without the user be able to acutally see the query source - so shouldn't need the view_query permission.

Technical details:

• Redash Version: 4.0.1+b4038

[guzhenping]

l cannot set time to refresh dashboard widgets. when l click '1 minute' button, it works. but if l refresh website(F5),the setting is from "1 minute" to "Refresh".

Does this bug cause ?

[Jeetah]

We also need this fixed to make the new Redash available for our customers. It's not acceptable that they see the insides of our DB.

[leonceeo]

Also blocked by this issue, I'm preparing a demo for a potential client, and I need refresh without letting him see the queries.

[kocsmy]

@guzhenping that's a different issue and it's pretty much how the dashboard refresh works at the moment. It's a "frontend" refresh so refreshing or restarting the browser will get this schedule lost. We'll change this behaviour in the future and this will be saved somehow.

[guzhenping]

@kocsmy get it ! thank you

[brainboog]

Is there a workaround for this bug? Refresh should be independent of the view_query permission, otherwise it's not possible to provide read-only dashboards for customers.

[thoechsmann]

We also need that.

Some people should be able to run a query with different parameters, but should not be able to change the sql query.

[arikfr]

We've started a project to redo permissions in Redash, which will also address this use case. To follow along you can watch #3284.