[Superset]: A "daf_viewers" user can delete a Superset table
Closed this issue · 3 comments
mariaclaudia commented
Subject of the issue
It's possible to delete a table in Superset with a "daf_viewers" user
Your environment
Chrome Version 66.0.3359.170 (Official Build) (64-bit)
Steps to reproduce
- login with an account with "daf_viewers" permission
- open Superset and go to Sources -> Tables in order to see the tables
- click on the icon "Delete record"
Expected behaviour
It should not possible to delete a table with a "Daf_viewers" profile
Actual behaviour
With a "daf_viewers" you can delete a record/table from superset
giux78 commented
@mariaclaudia domani segnalalo ad andrea lui credo sappia come risolverlo
altroisi commented
@mariaclaudia at the moment, superset doesn't view daf roles (e.g. daf_viewer and daf_editor). Since we are going to manage dataset only from the dataportal, we removed the delete table permission (can delete on TableModelView, muldelete on TableModelView
) for non-admin superset users
mariaclaudia commented
Fixed