Dashboards list includes dashboards with text widgets where you have no access to any other widgets

[yusha2016]

in this case, a use named A, he has not have any datasource access or view permission, while the dashboard have a text widget, the user A can find the dashboard which have text widget on dashboard lis page, the reason is than this python file: app/redash/model/init.py about the class Dashboard with that method :

    @classmethod
    def all(cls, org, group_ids, user_id):
        query = (
            Dashboard.query
            .options(
                subqueryload(Dashboard.user).load_only('_profile_image_url', 'name'),
            )
            .outerjoin(Widget)
            .outerjoin(Visualization)
            .outerjoin(Query)
            .outerjoin(DataSourceGroup, Query.data_source_id == DataSourceGroup.data_source_id)
            .filter(
                Dashboard.is_archived == False,
                (DataSourceGroup.group_id.in_(group_ids) |
                 (Dashboard.user_id == user_id)
                  ((Widget.dashboard != None) & (Widget.visualization == None))),
                Dashboard.org == org)
            .distinct())

        query = query.filter(or_(Dashboard.user_id == user_id, Dashboard.is_draft == False))

        return query

the query on Widget.visualization == None so will find all dashboard that have text widget

• Redash Version: 6.0.7.0.8.0
• Browser/OS: chrome/ios
• How did you install Redash: k8s

[arikfr]

It was implemented this way intentionally, but we no longer need this behavior. You're welcome to submit a Pull Request to update this behavior.