The title pretty much says it: If I add a block to the Dashboard and restrict it to certain roles, users of other roles will still see the block ... that is, a block with the title and the content replaced by 'empty'. Not pretty (and confusing).
As far as I can see, this is because of this in dashboard.module / dashboard_page_build
// Find blocks which were not yet displayed on the page (were empty), and
// add placeholder items in their place for rendering.
$block_list = db_select('block')
Afterwards, all rows returned by this query that is not an active block in the region is entered as an 'empty' block---including those that have been hidden because the user should not have acces to them. I assume that is not quite intended behavior?
I am not quite sure, though, because I don't understand why this (adding blocks back in as 'empty') is done in the first place ....
FAILED: [[SimpleTest]]: [MySQL] 39,783 pass(es), 1 fail(s), and 0 exception(s).
PASSED: [[SimpleTest]]: [MySQL] 39,749 pass(es).
PASSED: [[SimpleTest]]: [MySQL] 35,747 pass(es).
PASSED: [[SimpleTest]]: [MySQL] 33,343 pass(es).
FAILED: [[SimpleTest]]: [MySQL] Unable to apply patch 1009872-5-dashboard-invisible-blocks-show-as-empty.patch. This may be a -p0 (old style) patch, which is no longer supported by the testbots.