-
Notifications
You must be signed in to change notification settings - Fork 6.2k
Closed
Labels
.RegressionBugs that were previously fixed and/or bugs unintentionally shipped with new features.Bugs that were previously fixed and/or bugs unintentionally shipped with new features.Priority:P1Security holes w/o exploit, crashing, setup/upgrade, login, broken common features, correctnessSecurity holes w/o exploit, crashing, setup/upgrade, login, broken common features, correctnessType:BugProduct defectsProduct defects
Milestone
Description
Describe the bug
If you're a user without native sql permissions, you should be able to run SQL questions but not edit them, that works fine, but the issue happens when that user configures a subscription and sends it
Logs
:error "You do not have permissions to run this query.",
:row_count 0,
:running_time 0,
:ex-data
{:type :missing-required-permissions,
:required-permissions #{"/db/2/native/"},
:actual-permissions
#{"/collection/2/"
"/query/db/2/schema/"
"/download/db/2/native/"
"/data/db/2/"
"/collection/namespace/snippets/root/"
"/download/db/3/native/"
"/download/db/3/"
"/download/db/2/"
"/collection/root/"
"/application/subscription/"},
:permissions-error? true},
To Reproduce
- as an admin create a group and create a user. Assign this user to the group
- go to permissions and assign "no self service" to all users and to the newly created group
- create a dashboard and create a sql question ("select * from people") and add it to this dashboard
- log in as the user with "no self service" permission, go to the dashboard and create a subscription
- send it and you'll get

Expected behavior
A user without SQL permissions should be able to receive subscriptions of questions created in SQL, as it's able to run them when going to the metabase server
NOTE: watch out when fixing this, not to break sandboxing :)
Screenshots/videos
Above
Information about your Metabase Installation:
- Metabase version: 1.45.3...
Severity
P1
Additional context
NA
Metadata
Metadata
Assignees
Labels
.RegressionBugs that were previously fixed and/or bugs unintentionally shipped with new features.Bugs that were previously fixed and/or bugs unintentionally shipped with new features.Priority:P1Security holes w/o exploit, crashing, setup/upgrade, login, broken common features, correctnessSecurity holes w/o exploit, crashing, setup/upgrade, login, broken common features, correctnessType:BugProduct defectsProduct defects