New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

is it possible to disable public data download? #6369

Open
abizer opened this Issue Nov 12, 2017 · 8 comments

Comments

Projects
None yet
7 participants
@abizer

abizer commented Nov 12, 2017

I want to publicly distribute some graphs we've generated using Metabase by embedding them on our website, however, I'd like to prevent random people on the internet from downloading the raw data used to generate the graphs. Would it be possible to implement this feature? I don't know much about the technology used on the frontend of Metabase, but I think adding some way to toggle this line:

would suffice?

Thanks!

@stefanproell

This comment has been minimized.

Show comment
Hide comment
@stefanproell

stefanproell Dec 5, 2017

I would like to add that this feature would be great to have also internally, to prevent users from downloading data sets returned by answers to their questions. Ideally, this would be integrated into the permissions settings.

stefanproell commented Dec 5, 2017

I would like to add that this feature would be great to have also internally, to prevent users from downloading data sets returned by answers to their questions. Ideally, this would be integrated into the permissions settings.

@erix920

This comment has been minimized.

Show comment
Hide comment
@erix920

erix920 May 9, 2018

I would like this feature as well.

erix920 commented May 9, 2018

I would like this feature as well.

@tlrobinson

This comment has been minimized.

Show comment
Hide comment
@tlrobinson

tlrobinson May 9, 2018

Member

Are you trying to prevent non-sophisticated users from casually downloading the data, or are you trying to prevent even technical people from extracting the data?

It would certainly be possible to have a way to hide the button in the UI, however it would be the equivalent of "disabling right click". Someone moderately technical will still be able to look at the network requests and figure out how to get the data, since by necessity we need to pass the data to the frontend for visualization.

The only way to completely avoid that would be to render the visualizations server-side and display a non-interactive image of the visualization, which we don't support yet (see #4701), but you could implement with something like PhantomJS or Headless Chrome.

Member

tlrobinson commented May 9, 2018

Are you trying to prevent non-sophisticated users from casually downloading the data, or are you trying to prevent even technical people from extracting the data?

It would certainly be possible to have a way to hide the button in the UI, however it would be the equivalent of "disabling right click". Someone moderately technical will still be able to look at the network requests and figure out how to get the data, since by necessity we need to pass the data to the frontend for visualization.

The only way to completely avoid that would be to render the visualizations server-side and display a non-interactive image of the visualization, which we don't support yet (see #4701), but you could implement with something like PhantomJS or Headless Chrome.

@erix920

This comment has been minimized.

Show comment
Hide comment
@erix920

erix920 May 9, 2018

In our case, the raw data users are analyzing is publicly available so security isn't a high priority. It would be more beneficial to us for users to share a link to their question/dashboard to get other users into the system. Otherwise they'll be exporting xlsx files and we'll be back to the stone age.

In short - Yes, an option to disable the button through the UI would be great.

erix920 commented May 9, 2018

In our case, the raw data users are analyzing is publicly available so security isn't a high priority. It would be more beneficial to us for users to share a link to their question/dashboard to get other users into the system. Otherwise they'll be exporting xlsx files and we'll be back to the stone age.

In short - Yes, an option to disable the button through the UI would be great.

@MarcGJA

This comment has been minimized.

Show comment
Hide comment
@MarcGJA

MarcGJA Aug 5, 2018

The option to disable the download ability on all embedded resources is DEFINATELY a good idea! It's rather astonishing really that such an option hasn't been part of Metabase embedding from the get-go. Have to disagree with @tlrobinson, most embed end users are not even remotely technically inclined, a download disable option would be quite effective. Picture an app with embeds, for example, with three tiers of service, Free, Basic, and Premium where the Free tier does not have download ability. That's an additional incentive to driving Basic and Premium subscriptions!

MarcGJA commented Aug 5, 2018

The option to disable the download ability on all embedded resources is DEFINATELY a good idea! It's rather astonishing really that such an option hasn't been part of Metabase embedding from the get-go. Have to disagree with @tlrobinson, most embed end users are not even remotely technically inclined, a download disable option would be quite effective. Picture an app with embeds, for example, with three tiers of service, Free, Basic, and Premium where the Free tier does not have download ability. That's an additional incentive to driving Basic and Premium subscriptions!

@jornh

This comment has been minimized.

Show comment
Hide comment
@jornh

jornh Aug 5, 2018

Contributor

@abizer and @MarcGJA your use cases seem both to be with embedded or public sharing.

For that a quick and simple workaround is to publish a dashboard which (currently ) doesn't have the download option. See https://www.pursuittechnology.co.uk/products/metabase/ for a demo page where you can compare the two embedded in the same public page. And yes you can also make a dashboard with only one big question 🙂

Contributor

jornh commented Aug 5, 2018

@abizer and @MarcGJA your use cases seem both to be with embedded or public sharing.

For that a quick and simple workaround is to publish a dashboard which (currently ) doesn't have the download option. See https://www.pursuittechnology.co.uk/products/metabase/ for a demo page where you can compare the two embedded in the same public page. And yes you can also make a dashboard with only one big question 🙂

@MarcGJA

This comment has been minimized.

Show comment
Hide comment
@MarcGJA

MarcGJA Aug 6, 2018

Thank you @jornh, that's a very good suggestion, helps me out allot! There have been requests for downloading from individual cards in dashboards, however, so we'll have to keep a lookout for when that comes into play. As is users wishing to download have to fish around for the corresponding chart which can be rather frustrating so it will be nice when they can finally download directly from the dashboard cards!

MarcGJA commented Aug 6, 2018

Thank you @jornh, that's a very good suggestion, helps me out allot! There have been requests for downloading from individual cards in dashboards, however, so we'll have to keep a lookout for when that comes into play. As is users wishing to download have to fish around for the corresponding chart which can be rather frustrating so it will be nice when they can finally download directly from the dashboard cards!

@MarcGJA

This comment has been minimized.

Show comment
Hide comment
@MarcGJA

MarcGJA Oct 9, 2018

@jornh, Would you know if a disabling downloads option is in the pipeline or is it already there and I just haven't found it? Now that downloads can be done from dashboards (which is VERY welcome) the single-chart dashboard workaround is no longer an option. Surely there are plenty of admins who'd make use of disabling downloads to justify having such a simple option in there somewhere.

MarcGJA commented Oct 9, 2018

@jornh, Would you know if a disabling downloads option is in the pipeline or is it already there and I just haven't found it? Now that downloads can be done from dashboards (which is VERY welcome) the single-chart dashboard workaround is no longer an option. Surely there are plenty of admins who'd make use of disabling downloads to justify having such a simple option in there somewhere.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment