Cannot Hide Full User List in Saved Queries List View Dropdown

Superset does not allow users to have access to the Saved Queries “list” functionality without allowing them to see the full list of Superset users.

Expected results

Superset should (IMO) have a permission that allows administrators to hide the full list of users from a given user.

Actual results

When “Saved Queries” are enabled for users, they immediately gain access to the full user list–and administrators don’t seem to have the ability to hide this potentially sensitive information.

Screenshots

How to reproduce the bug

1. Grant a role the ability to use Saved Queries (i.e. list, show, add, delete…saved queries permissions).

2. Add a user to that role

3. Attempt to prevent that user from accessing the full list of users when the user navigates to the /savedqueryview/list/ page

Environment

• superset version: 0.32.0rc2
• python version: 3.6
• node.js version: Unknown
• npm version: Unknown

Checklist

Make sure these boxes are checked before submitting your issue - thank you!

• I have checked the superset logs for python stacktraces and included it here as text if there are any.
• I have reproduced the issue with at least the latest released version of superset.
• I have checked the issue tracker for the same issue and I haven’t found one similar.

Additional context

N/A

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label #enhancement to this issue, with a confidence of 0.67. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. For admin, please label this issue .pinned to prevent stale bot from closing the issue.