Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Users should only be able to edit dashboards if they have "django_sql_dashboard.execute_sql" permission #94

Closed
simonw opened this issue May 10, 2021 · 0 comments
Closed

Users should only be able to edit dashboards if they have "django_sql_dashboard.execute_sql" permission #94

simonw opened this issue May 10, 2021 · 0 comments
Labels
security
Milestone
0.14

Comments

@simonw
Copy link
Owner

simonw commented May 10, 2021

The purpose of django_sql_dashboard.execute_sql is to restrict who can execute arbitrary SQL. The edit_policy feature could allow people to create dashboards that can be edited by other users using the Django Admin interface, even if those users do not have the execute_sql permission.
@simonw simonw added this to the 0.14 milestone May 16, 2021
@simonw simonw closed this as completed in e31e954 May 16, 2021
simonw added a commit that referenced this issue May 16, 2021
@simonw
Release 0.14
c13ab2a 
Refs #30, #93, #94, #95, #96, #97, #98, #100, #101, #102, #103, #104, #105, #106, #107, #108, #109
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security
Projects
None yet
Milestone
0.14
Development

No branches or pull requests
1 participant
@simonw