If you make a report private or you do not share it with the other users they cannot customize it
There are no permission limitations on the folders. I will create a github issue so we can look into it in the future.
How you see, the ideia for create a new globalVariable for hide this buttons ?
I will explain
This facility appears good, because allows user can get any data from system.
But this a big problem for performance and BD administration
Because user, in most times, uses a field not is prepared for search, not a key, or using a field for group by, the same way, not prepared for this.
This queries in BD, in most cases , search all table, for each execution, introducing an overload in server.
In production environment, i think only specific user can make this kind of changes.