simonw / django-sql-dashboard

Django app for building dashboards using raw SQL queries
https://django-sql-dashboard.datasette.io/
Apache License 2.0
437 stars 37 forks source link

Users should only be able to edit dashboards if they have "django_sql_dashboard.execute_sql" permission #94

Closed simonw closed 3 years ago

simonw commented 3 years ago

The purpose of django_sql_dashboard.execute_sql is to restrict who can execute arbitrary SQL. The edit_policy feature could allow people to create dashboards that can be edited by other users using the Django Admin interface, even if those users do not have the execute_sql permission.