simonw/django-sql-dashboard

Make "export all to csv/tsv" button available on saved dashboards to users with execute_sql permission

toolness opened this issue · 3 comments

It looks like this button, which was added in #50, might only be available on unsaved dashboards? Either that or I'm somehow not seeing it on the saved dashboard page...

This is deliberate, because the "export all" operation is potentially quite expensive - I don't want to accidentally open that up to anyone on a public dashboard, since that could potentially be used for a denial of service attack.

It is however a frustrating limitation - maybe the answer here is to enable it on saved dashboards but only for users who have the execute_sql permission.

Er, so yeah, in practice this has definitely been a frustrating limitation, since almost all of our use cases for the dashboard are for generating long lists of results to be exported as CSV. Mind if I issue a PR that does what you proposed above (enabling "export all as CSV" but only for users who have the execute_sql permission)?