Truncating table from native query possible?!

Get Help
1

Hi!

While playing around with Metabase, I tried to run a "TRUNCATE table_name" statement - and to my surprise, it worked and actually deleted all data from the respective table (the syntax without the TABLE keyword is PostgreSQL specific).

My user has the permission to do native queries, but I was under the impression that Metabase is always "read only". I saw that theres a new feature "metabase actions", but is this intended behavior?

We're running Metabase 50.8 with a PostgreSQL DB.

Thanks,
Florian

2

Your database user needs their rights restricting, not the user in Metabase.

3

Sure, I can limit the permissions a (DB) user has, but: I was under the assumption that Metabase questions, even native ones, are still "read only" regarding the DB data.
Has this been changed at some point in time or was I wrong on the past?

4

The SQL query you create is what will be executed! Good reason to use views in a different schema.

5

We changed that in v47.7 to improve the speed as we were handling the transactions on our end. We decided to set everything to autocommit

Either way, you should be able to set the db to readonly, check "readOnly=true" in additional JDBC options is ignored (?) · Issue #47084 · metabase/metabase · GitHub