Restrict permissions in roles to not download data table visualization CSV

Sandeep_Raju · November 24, 2022, 7:57am

Hi,
I'm Using Kibana 7.10.0

Is there a way(role) to show Dashboard/Visualization & user should not download CSV of the data table visualization ?

I'm having dashboard with data table visualizations.
I have tried different permissions for my custom roles for user.
But I can't restrict Download CSV option ( Both Raw & Formatted).

I can give a role , but User cannot see visualization/Dashboard.
I want to give him option to see visualization, but not download CSV option.

ppisljar · November 24, 2022, 10:02am

I don't think this is currently supported. Feel free to open a feature request at Issues · elastic/kibana · GitHub

Sandeep_Raju · November 29, 2022, 5:03am

This is a security issue as user can download CSV even after read only access.

Have raised an issue:

github.com/elastic/kibana

Unable to restrict CSV Download for any Role & User [Security Solution]

opened 01:19PM - 28 Nov 22 UTC

Sandy381

bug Team:Security triage_needed

**Read-only Role :** Unable to restrict CSV Download for Read-Only Role or any R…ole. **Kibana/Elasticsearch Stack version:** 8.5.2 **Browser and Browser OS versions:** Google Chrome **Functional Area (e.g. Endpoint management, timelines, resolver, etc.):** Security **Steps to reproduce:** 1. Apply Read-Only Role to a User or Equivalent Role. Map the user to that role. 2.Apply Appropriate restrictions for user for Dashboard access. Apply Read-only Access to Dashboard. 3.Login as that user and check for dashboard. **Current behavior:** Read-Only applies to all aspects . Able to see the dashboard. Unable to download PDF & PNG reports. Able to download CSV Reports. Have applied all roles. **Expected behavior:** Read-Only applies to all aspects . Able to see the dashboard. Unable to download PDF & PNG & CSV Reports. User should see Dashboard, but not download CSV reports. We can restrict PDF & PNG reports using reporting, but cannot restrict CSV downloads. Want to show dashboard, but restrict CSV download. **Screenshots (if relevant):** ![Screenshot 2022-11-28 at 5 17 35 PM](https://user-images.githubusercontent.com/74658016/204287367-6cc3cbc8-8417-4604-a285-d1b12746aa4b.png) **Any additional context (logs, chat logs, magical formulas, etc.):** User can download CSV reports by clicking on "Raw" & "Formatted" Download Buttons or Click on "Inspect" and Select Data and download CSV Reports.Cannot restrict CSV reports in anyway.

system · December 27, 2022, 5:04am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.