[Superset]: A "daf_viewers" user can delete a Superset table

[mariaclaudia]

Subject of the issue

It's possible to delete a table in Superset with a "daf_viewers" user

Your environment

Chrome Version 66.0.3359.170 (Official Build) (64-bit)

Steps to reproduce

• login with an account with "daf_viewers" permission
• open Superset and go to Sources -> Tables in order to see the tables
• click on the icon "Delete record"

Expected behaviour

It should not possible to delete a table with a "Daf_viewers" profile

Actual behaviour

With a "daf_viewers" you can delete a record/table from superset

Please see attached the profile I used to delete a table:

[giux78]

@mariaclaudia domani segnalalo ad andrea lui credo sappia come risolverlo

[altroisi]

@mariaclaudia at the moment, superset doesn't view daf roles (e.g. daf_viewer and daf_editor). Since we are going to manage dataset only from the dataportal, we removed the delete table permission (can delete on TableModelView, muldelete on TableModelView) for non-admin superset users

[mariaclaudia]

Fixed