Problem with permissions

[Tri0L]

Issue Summary

User with just view_query,list_dashboards permissions can execute query and see all data on dashboards.

Steps to Reproduce

1. Redash Version: 8.0.0+b32245 (a16f551)
2. Create group with permissions view_query,list_dashboards
3. Open any dashboard

Expected

User without execute_query permission can't see any data.

[arikfr]

It might be a case of confusing naming, but view_query means they can see query and its results. They can also refresh the queries they have access too.

If you want to limit their access, you can move them to a different group and assign relevant permissions to relevant data sources.

I'm closing this, but you're welcome to continue conversation.

[Tri0L]

Which difference between execute_query and view_query?

[arikfr]

Without execute_query you can't execute adhoc queries (only already saved ones).