<p dir="auto">If a metric is deleted, charts using it in a single-value MetricControl won't be able to replace it with another metric.</p>
<h4 dir="auto">Screenshots</h4>
<p dir="auto"><a target="_blank" rel="noopener noreferrer nofollow" href="https://user-images.githubusercontent.com/335541/114797075-34dbf000-9d47-11eb-8494-734d3b54545a.png"><img width="783" alt="deleted-metric-bug" src="https://user-images.githubusercontent.com/335541/114797075-34dbf000-9d47-11eb-8494-734d3b54545a.png" style="max-width: 100%;"></a></p>
<h4 dir="auto">How to reproduce the bug</h4>
<ol dir="auto">
<li>Add a saved metric to a chart using single-value metric select (e.g. Country Map or Pie Chart).</li>
<li>Save the chart</li>
<li>Delete said metric in Datasource editor and save.</li>
<li>Refresh the page.</li>
</ol>
<h3 dir="auto">Environment</h3>
<p dir="auto">Latest master</p>
<p dir="auto">Make sure these boxes are checked before submitting your issue - thank you!</p>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have checked the superset logs for python stacktraces and included it here as text if any</li>
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have reproduced the issue with at least the latest released version of superset</li>
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have checked the issue tracker for the same issue and I haven't found one similar</li>
</ul>
<h3 dir="auto">Superset version</h3>
<p dir="auto">Reproduced the issue on versions:</p>
<ul dir="auto">
<li>0.17.0</li>
<li>0.17.3</li>
</ul>
<h3 dir="auto">Expected results</h3>
<p dir="auto">Exporting and importing dashboard anonymously should fail with an authorization error unless permissions were granted to the <code class="notranslate">Public</code> role.</p>
<h3 dir="auto">Actual results</h3>
<ul dir="auto">
<li>No authorization checks occur on dashboard export or import.</li>
<li>Dashboards and slices are successfully exported and will be imported without an owner ID (effectively creating a duplicate dashboard / slices)</li>
</ul>
<h3 dir="auto">Steps to reproduce</h3>
<ul dir="auto">
<li>Install Superset</li>
<li>Configure a data source</li>
<li>Create a slice</li>
<li>Create a dashboard and add the slice</li>
<li>Note the ID of the dashboard</li>
<li>Use <code class="notranslate">curl</code> to export the dashboard to a pickle file (see below for actual command)</li>
<li>Optionally modify the existing dashboard</li>
<li>Use <code class="notranslate">curl</code> to import the dashboard</li>
<li>See that the imported dashboard is created without an owner</li>
</ul>
<p dir="auto"><strong>curl commands</strong></p>
<p dir="auto">Export the dashboard with a given ID:</p>
<ul dir="auto">
<li>This will export the dashboard with ID=6 and save the output as <code class="notranslate">test.pickle</code></li>
</ul>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ curl 'http://localhost:8088/dashboardmodelview/export_dashboards_form?id=6&amp;action=go' -o test.pickle"><pre class="notranslate"><code class="notranslate">$ curl 'http://localhost:8088/dashboardmodelview/export_dashboards_form?id=6&amp;action=go' -o test.pickle
</code></pre></div>
<p dir="auto">Import the dashboard back into Superset:</p>
<ul dir="auto">
<li>This will import the above <code class="notranslate">test.pickle</code> file back into Superset</li>
</ul>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ curl -X POST http://localhost:8088/superset/import_dashboards -F &quot;file=@test.pickle&quot;"><pre class="notranslate"><code class="notranslate">$ curl -X POST http://localhost:8088/superset/import_dashboards -F "file=@test.pickle"
</code></pre></div>
<h3 dir="auto">Other details</h3>
<ul dir="auto">
<li>OS is CentOS 7</li>
<li>Configuration has <code class="notranslate">AUTH_ROLE_PUBLIC = 'Public'</code></li>
<li>The <code class="notranslate">Public</code> role has the default empty set of permissions</li>
</ul>