Permission rules changed from latest updates (v0.63.10)

Get Help FAQ
1

Hi team,

I updated my self-hosted Metabase instance to the latest v0.63.10 today due to the announced security updates.

This new version has broken a few reports that I have, and my takeaway is that this version changed how the "permission rules" used to work in Metabase. Eventually, I believe this might be a problem for other people as well I'd like to use this thread to discuss potential solutions.

What happened is, up to the previous version, I was using v0.58.3:

  • A user does not have access to determined table, but they have access to a dashboard and question (saved within that dashboard or in any other place they have access):
    • When they opened that dashboard, they would see the question normally but if they try to "drill through" they would see the view only flag.

What happens now v0.63.10

  • The question doesn't load anymore ("Sorry, you don't have permission to see this card" or "Sorry, you don't have permission to run this query"), because they don't have access to the table and/or the question/model this question is built on top.

So in summary:

  • Before they could see the data if they are accessing a question they have access to see - regardless their access to the source (table, question, or model)

  • Now, they cannot see the data if they are accessing a question that they have access to see - howver this question is based in a model/question that they don't have access to see.

  • If the question is based in a table they don't have access to see, then it keeps working normally, it looks like it has affected only if the source is a question/model, and not a table.

This is a big deal for me at the moment, because as I built many things in Metabase relying on this behaviour my reports are now broken as this rule has changed.

Any ideas/suggestions?

Thanks.

2

It’s happening in a worse way with Models. They have to be able to view the entire model. This just blows away data security.

There’s a github discussion relating to 58, but it affects all versions. here: Upgrade from v0.58.24 to v0.58.28 all users cannot open any dashboard card based on a Model · Issue #79750 · metabase/metabase · GitHub

1 Like
3

I am now in a similar situation, for me/us this is especially “a thing” for SQL question. We (used to) create SQL questions and then grant users view permissions on these.

I solved it the following way, as I documented in my comment on Github:

Parse SQL in order to enforce permissions · Issue #10525 · metabase/metabase · GitHub

(Generally I find the “view only” feature great for some use-cases, where we esp. don’t want to create/share/maintain a database connection expicitly for a permission group)