View-only users cannot execute queries with parameters

Issue Summary

Not an issue maybe, but at least a problematic behaviour for us.

Steps to Reproduce

1. Create a query with query parameters
2. Set the datasource for this query to a datasource where another user has only the view-only permission
3. With this other user, try to inject parameters and then click the refresh button
4. See this error message

I expect it to be okay (or at least that can be allowed) to execute queries with query parameters for view-only users.

Technical details:

• Redash Version: 0.11.0+b1959
• Browser/OS: Chrome / OS X
• How did you install Redash: AMI

[wichert]

Why was this ticket closed? As far as I can see this problem still remains.

[jgoux]

I needed to organize my groups into 3 categories :

• admin : have all permissions
• default : have no permission
• readonly : have readonly permissions and can execute queries with parameters

This is what I did in database in order to achieve my organisation, all the values concern the table groups and the column permissions

• admin : {admin,super_admin,create_dashboard,create_query,edit_dashboard,edit_query,view_query,view_source,execute_query,list_users,schedule_query,list_dashboards,list_alerts,list_data_sources}
• default : {}
• readonly : {list_dashboards,view_query,execute_query}

In order to be able to run parametrized queries as a member of the readonly group, you need to define the datasources for the group as Full Access or it won’t work!

Hope this helps 👍