starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-03-24 02:11:50 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Fixes #4146: Fix SecretRole permissions enforcement

Browse Source
This commit is contained in:
Jeremy Stretch
2020-02-12 11:13:32 -05:00
parent e4b910fe87
commit 5bf85597ed
5 changed files with 49 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
netbox/secrets/api/views.py
View File

@@ -93,8 +93,8 @@ class SecretViewSet(ModelViewSet):
secret = self.get_object()
# Attempt to decrypt the secret if the master key is known
if self.master_key is not None:
# Attempt to decrypt the secret if the user is permitted and the master key is known
if secret.decryptable_by(request.user) and self.master_key is not None:
secret.decrypt(self.master_key)
serializer = self.get_serializer(secret)
@@ -111,7 +111,9 @@ class SecretViewSet(ModelViewSet):
if self.master_key is not None:
secrets = []
for secret in page:
secret.decrypt(self.master_key)
# Enforce role permissions
if secret.decryptable_by(request.user):
secret.decrypt(self.master_key)
secrets.append(secret)
serializer = self.get_serializer(secrets, many=True)
else: