gamma: limit owners to dashboard to self

As we don't want to leak other users to unpriviliged users

Refs #359

caravel/views.py

@@ -178,6 +178,14 @@ def apply(self, query, value):  # noqa
         return qry
 
 
+class FilterDashboardOwners(CaravelFilter):
+    def apply(self, query, value):  # noqa
+        if any([r.name in ('Admin', 'Alpha') for r in get_user_roles()]):
+            return query
+        qry = query.filter_by(id=g.user.id)
+        return qry
+
+
 def validate_json(form, field):  # noqa
     try:
         json.loads(field.data)
@@ -674,8 +682,14 @@ class DashboardModelView(CaravelModelView, DeleteMixin):  # noqa
         'owners': _("Owners is a list of users who can alter the dashboard."),
     }
     base_filters = [['slice', FilterDashboard, lambda: []]]
-    add_form_query_rel_fields = {'slices': [['slices', FilterDashboardSlices, None]]}
-    edit_form_query_rel_fields = {'slices': [['slices', FilterDashboardSlices, None]]}
+    add_form_query_rel_fields = {
+        'slices': [['slices', FilterDashboardSlices, None]],
+        'owners': [['owners', FilterDashboardOwners, None]],
+    }
+    edit_form_query_rel_fields = {
+        'slices': [['slices', FilterDashboardSlices, None]],
+        'owners': [['owners', FilterDashboardOwners, None]],
+    }
     label_columns = {
         'dashboard_link': _("Dashboard"),
         'dashboard_title': _("Title"),