Fix: allow users with view only acces to use the queries in Query Results

redash/query_runner/query_results.py

@@ -3,7 +3,7 @@
 import sqlite3
 
 from redash import models
-from redash.permissions import has_access, not_view_only
+from redash.permissions import has_access, view_only
 from redash.query_runner import BaseQueryRunner, TYPE_STRING, guess_type, register
 from redash.utils import json_dumps, json_loads
 
@@ -24,7 +24,8 @@ def extract_query_ids(query):
 
 
 def extract_cached_query_ids(query):
-    queries = re.findall(r'(?:join|from)\s+cached_query_(\d+)', query, re.IGNORECASE)
+    queries = re.findall(r'(?:join|from)\s+cached_query_(\d+)', query,
+                         re.IGNORECASE)
     return [int(q) for q in queries]
 
 
@@ -34,9 +35,12 @@ def _load_query(user, query_id):
     if user.org_id != query.org_id:
         raise PermissionError("Query id {} not found.".format(query.id))
 
-    if not has_access(query.data_source, user, not_view_only):
-        raise PermissionError(u"You are not allowed to execute queries on {} data source (used for query id {}).".format(
-            query.data_source.name, query.id))
+    # TODO: this duplicates some of the logic we already have in the redash.handlers.query_results.
+    # We should merge it so it's consistent.
+    if not has_access(query.data_source, user, view_only):
+        raise PermissionError(
+            u"You are not allowed to execute queries on {} data source (used for query id {})."
+            .format(query.data_source.name, query.id))
 
     return query
 
@@ -47,16 +51,22 @@ def get_query_results(user, query_id, bring_from_cache):
         if query.latest_query_data_id is not None:
             results = query.latest_query_data.data
         else:
-            raise Exception("No cached result available for query {}.".format(query.id))
+            raise Exception("No cached result available for query {}.".format(
+                query.id))
     else:
-        results, error = query.data_source.query_runner.run_query(query.query_text, user)
+        results, error = query.data_source.query_runner.run_query(
+            query.query_text, user)
         if error:
-            raise Exception("Failed loading results for query id {}.".format(query.id))
+            raise Exception("Failed loading results for query id {}.".format(
+                query.id))
 
     return json_loads(results)
 
 
-def create_tables_from_query_ids(user, connection, query_ids, cached_query_ids=[]):
+def create_tables_from_query_ids(user,
+                                 connection,
+                                 query_ids,
+                                 cached_query_ids=[]):
     for query_id in set(cached_query_ids):
         results = get_query_results(user, query_id, True)
         table_name = 'cached_query_{query_id}'.format(query_id=query_id)
@@ -81,8 +91,7 @@ def flatten(value):
 
 def create_table(connection, table_name, query_results):
     try:
-        columns = [column['name']
-                   for column in query_results['columns']]
+        columns = [column['name'] for column in query_results['columns']]
         safe_columns = [fix_column_name(column) for column in columns]
 
         column_list = ", ".join(safe_columns)
@@ -91,7 +100,8 @@ def create_table(connection, table_name, query_results):
         logger.debug("CREATE TABLE query: %s", create_table)
         connection.execute(create_table)
     except sqlite3.OperationalError as exc:
-        raise CreateTableError(u"Error creating table {}: {}".format(table_name, exc.message))
+        raise CreateTableError(u"Error creating table {}: {}".format(
+            table_name, exc.message))
 
     insert_template = u"insert into {table_name} ({column_list}) values ({place_holders})".format(
         table_name=table_name,
@@ -108,11 +118,7 @@ class Results(BaseQueryRunner):
 
     @classmethod
     def configuration_schema(cls):
-        return {
-            "type": "object",
-            "properties": {
-            }
-        }
+        return {"type": "object", "properties": {}}
 
     @classmethod
     def annotate_query(cls):
@@ -127,16 +133,17 @@ def run_query(self, query, user):
 
         query_ids = extract_query_ids(query)
         cached_query_ids = extract_cached_query_ids(query)
-        create_tables_from_query_ids(user, connection, query_ids, cached_query_ids)
+        create_tables_from_query_ids(user, connection, query_ids,
+                                     cached_query_ids)
 
         cursor = connection.cursor()
 
         try:
             cursor.execute(query)
 
             if cursor.description is not None:
-                columns = self.fetch_columns(
-                    [(i[0], None) for i in cursor.description])
+                columns = self.fetch_columns([(i[0], None)
+                                              for i in cursor.description])
 
                 rows = []
                 column_names = [c['name'] for c in columns]