Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revision History shows Revert button when user only has view-only permissions #13229

Closed
flamber opened this issue Sep 10, 2020 · 4 comments
Closed
Assignees
Labels
Priority:P2 Average run of the mill bug Querying/ .Reproduced Issues reproduced in test (usually Cypress) Type:Bug Product defects
Milestone

Comments

@flamber
Copy link
Contributor

flamber commented Sep 10, 2020

Describe the bug
Revert button is shown even when the user doesn't have permissions to modify question.

To Reproduce

  1. Create a question, save as "Q1" to "Our Analytics", make a modification and save again
  2. Admin > Permissions > Collections > set "Our Analytics" to view-only
  3. Admin > People > create new user "U1"
  4. Login as "U1" > Our Analytics > Q1 > click pencil-icon next to question title > View revision history > clicking Revert button will make the button show Revert failed:
    image

Expected behavior
Revert button shouldn't be shown, when user doesn't have permissions to modify question.

Information about your Metabase Installation:
Metabase 0.36.4

@mazameli
Copy link
Contributor

mazameli commented Mar 18, 2021

Yikes, this feels higher than a P3 to me. This effectively means that someone without edit access can edit a dashboard, though in a limited way. I see now that they can't actually revert, and that they get an error.

@mazameli mazameli added Priority:P2 Average run of the mill bug and removed Priority:P3 Cosmetic bugs, minor bugs with a clear workaround labels Mar 18, 2021
@brunobergher
Copy link
Contributor

It's annoying indeed, but it seems to me that the action actually fails, right?

@mazameli
Copy link
Contributor

Mea culpa — I'm guilty of not reading that carefully. I'm inclined to leave it as a P2, though — if I'm an admin and I log in as a more restricted user account to check things out and make sure people have the correct access and then I see this, maybe I get the mistaken impression that View-only users could revert things. Even if I click and see the failure, I still am not clear what Metabase's intention is here — are View-only users supposed to be able to revert, and would they be able to if the revert had not failed?

nemanjaglumac added a commit that referenced this issue Mar 19, 2021
nemanjaglumac added a commit that referenced this issue Mar 19, 2021
@nemanjaglumac nemanjaglumac added the .Reproduced Issues reproduced in test (usually Cypress) label Mar 19, 2021
@kulyk kulyk self-assigned this Apr 16, 2021
kulyk added a commit that referenced this issue Apr 16, 2021
kulyk added a commit that referenced this issue Apr 19, 2021
…missions (#15654)

* Fix dashboard edit action visibility

Hiding "Change title and description" from users with read-only access to dashboard

* Fix dashboard archive action visibility

Hiding "Archive" action from users with read-only permission to dashboard

* Enable #13229 repro test

* Test user with read permissions can't revert question history

* Fix user with read-only permissions sees revert buttons
@kulyk
Copy link
Member

kulyk commented Apr 27, 2021

Fixed by #15654

This was referenced Feb 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Priority:P2 Average run of the mill bug Querying/ .Reproduced Issues reproduced in test (usually Cypress) Type:Bug Product defects
Projects
Development

No branches or pull requests

5 participants