View only user cannot resize column width.

[timhughes]

Issue

When a user with read only access to a question changes a column width in the browser Metabase attempts to create a new question and then the data cannot be refreshed.

Inspecting the response from the server we see the following stacktrace

0	--> query_processor.middleware.permissions$fn__35096$check_ad_hoc_query_perms__35101$fn__35102.invoke(permissions.clj:26)
1	query_processor.middleware.permissions$fn__35096$check_ad_hoc_query_perms__35101.invoke(permissions.clj:22)
2	query_processor.middleware.permissions$fn__35119$check_query_permissions_STAR___35124$fn__35130.invoke(permissions.clj:34)
3	query_processor.middleware.permissions$fn__35119$check_query_permissions_STAR___35124.invoke(permissions.clj:28)
4	query_processor.middleware.cumulative_aggregations$handle_cumulative_aggregations$fn__31914.invoke(cumulative_aggregations.clj:57)
5	query_processor.middleware.limit$limit$fn__32405.invoke(limit.clj:17)
6	query_processor.middleware.results_metadata$record_and_return_metadata_BANG_$fn__37481.invoke(results_metadata.clj:87)
7	query_processor.middleware.format_rows$format_rows$fn__32395.invoke(format_rows.clj:26)
8	query_processor.middleware.add_dimension_projections$add_remapping$fn__30551.invoke(add_dimension_projections.clj:234)
9	query_processor.middleware.add_row_count_and_status$add_row_count_and_status$fn__30839.invoke(add_row_count_and_status.clj:15)
10	query_processor.middleware.driver_specific$process_query_in_context$fn__32156.invoke(driver_specific.clj:12)
11	query_processor.middleware.resolve_driver$resolve_driver$fn__35279.invoke(resolve_driver.clj:15)
12	query_processor.middleware.bind_effective_timezone$bind_effective_timezone$fn__31351$fn__31352.invoke(bind_effective_timezone.clj:9)
13	util.date$call_with_effective_timezone.invokeStatic(date.clj:88)
14	util.date$call_with_effective_timezone.invoke(date.clj:77)
15	query_processor.middleware.bind_effective_timezone$bind_effective_timezone$fn__31351.invoke(bind_effective_timezone.clj:8)
16	query_processor.middleware.store$initialize_store$fn__37496$fn__37497.invoke(store.clj:11)
17	query_processor.store$do_with_new_store.invokeStatic(store.clj:34)
18	query_processor.store$do_with_new_store.invoke(store.clj:30)
19	query_processor.middleware.store$initialize_store$fn__37496.invoke(store.clj:10)
20	query_processor.middleware.cache$maybe_return_cached_results$fn__31773.invoke(cache.clj:127)
21	query_processor.middleware.catch_exceptions$catch_exceptions$fn__31821.invoke(catch_exceptions.clj:64)
22	query_processor$process_query.invokeStatic(query_processor.clj:213)
23	query_processor$process_query.invoke(query_processor.clj:209)
24	query_processor$run_and_save_query_BANG_.invokeStatic(query_processor.clj:322)
25	query_processor$run_and_save_query_BANG_.invoke(query_processor.clj:316)
26	query_processor$fn__37661$process_query_and_save_execution_BANG___37666$fn__37667.invoke(query_processor.clj:354)
27	query_processor$fn__37661$process_query_and_save_execution_BANG___37666.invoke(query_processor.clj:340)
28	query_processor$fn__37685$process_query_and_save_with_max_BANG___37690$fn__37691.invoke(query_processor.clj:373)
29	query_processor$fn__37685$process_query_and_save_with_max_BANG___37690.invoke(query_processor.clj:369)
30	api.dataset$fn__44186$fn__44189.invoke(dataset.clj:45)
31	api.common$fn__23166$invoke_thunk_with_keepalive__23171$fn__23172$fn__23173.invoke(common.clj:435)

Environment

• Browser: Firefox
• Version: 66.0.2
• Build ID: 20190401084844
• User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0
• OS: Linux 5.0.6-200.fc29.x86_64
• Databases: Mysql 5.7 - Percona-Server-server-57-5.7.23-23.1.el6.x86_64
• Metabase version: v0.31.1
• Metabase hosting environment: Centos 6
• Metabase internal database: H2 (default)

Repeatable steps to reproduce the issue.

Create a new collection
Inside the collection create a question with visualization as table.
Create a new group that has View access to the collection and no other permissions.
Create a new user and put them in that group only.
Log in as the user and go to the question.
Change a column width.
At this point Metabase attempts to start a new question but because the user is view only they cannot refresh the data.
This issue also occurs if the user changes the visualization type and tries to refresh the data.

I notice when the column width is changed the url changes from something like:
https://metabase.ix3.lmax/metabase/question/137?selected_date=2019-04-04
to

https://metabase.ix3.lmax/metabase/question?selected_date=2019-04-04#eyJkYXRhc2V0X3F1ZXJ5Ijp7ImRhdGFiYXNlIjoyLCJuYXRpdmUiOnsicXVlcnkiOiJIZXJlIGlzIHdoZXJlIHRoZSBzcWwgZ29lcyB0aGF0IEkgaGF2ZSByZW1vdmVkLiBDaGVlcnMgZm9yIGxvb2tpbmcgOi0pIiwidGVtcGxhdGUtdGFncyI6eyJzZWxlY3RlZF9kYXRlIjp7ImRpc3BsYXktbmFtZSI6IlNlbGVjdGVkIGRhdGUiLCJpZCI6ImY1NTJmYTI0LTVkMDUtMTFlOS05ZmFhLTBlODNjMjQ3ZDc2NCIsIm5hbWUiOiJzZWxlY3RlZF9kYXRlIiwicmVxdWlyZWQiOnRydWUsInR5cGUiOiJkYXRlIn19fSwidHlwZSI6Im5hdGl2ZSJ9LCJkaXNwbGF5IjoidGFibGUiLCJ2aXN1YWxpemF0aW9uX3NldHRpbmdzIjp7InRhYmxlLmNvbHVtbl93aWR0aHMiOltudWxsLG51bGwsbnVsbCxudWxsLDQyMl19fSAK

Expected behaviour / User stories.

• As a view only user I would expect that I could change the presentation of data such as column width or visualization type and be able to refresh the data.
• Bonus: It would be good if these changes could be remembered when I came back to the same question. I understand that this might be difficult if the question is used in a dashboard or pulse though.

[timhughes]

Closing bugs I am not going to fix myself.

[nemanjaglumac]

Cannot reproduce locally.
Made Cypress repro that passes. It seems this issue has been fixed in the meantime.

[flamber]

Very likely fixed by #15424 in 0.38.3