From fea6ad61fd90575a1a9da8ebed63a8e550d4bb8d Mon Sep 17 00:00:00 2001
From: Martin Hauser <mhauser@netboxlabs.com>
Date: Thu, 12 Mar 2026 17:30:40 +0100
Subject: [PATCH] fix(virtualization): Hide VM Add Components dropdown without
 change permission (#21634)

Wrap the VirtualMachine "Add Components" dropdown in a
`virtualization.change_virtualmachine` permission check to match Device
behavior and prevent users without change permission from seeing
component add actions.

Fixes #21580
---
 .../virtualization/virtualmachine/base.html   | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/netbox/templates/virtualization/virtualmachine/base.html b/netbox/templates/virtualization/virtualmachine/base.html
index 610af6fb9..176a63141 100644
--- a/netbox/templates/virtualization/virtualmachine/base.html
+++ b/netbox/templates/virtualization/virtualmachine/base.html
@@ -16,23 +16,23 @@
 {% endblock %}
 
 {% block extra_controls %}
-
-  <div class="dropdown">
+  {% if perms.virtualization.change_virtualmachine %}
+    <div class="dropdown">
       <button id="add-components" type="button" class="btn btn-primary dropdown-toggle" data-bs-toggle="dropdown" aria-expanded="false">
-          <i class="mdi mdi-plus-thick" aria-hidden="true"></i> {% trans "Add Components" %}
+        <i class="mdi mdi-plus-thick" aria-hidden="true"></i> {% trans "Add Components" %}
       </button>
       <ul class="dropdown-menu" aria-labeled-by="add-components">
-          {% if perms.virtualization.add_vminterface %}
-            <li><a class="dropdown-item"  href="{% url 'virtualization:vminterface_add' %}?virtual_machine={{ object.pk }}&return_url={% url 'virtualization:virtualmachine_interfaces' pk=object.pk %}">
-              {% trans "Interfaces" %}
-            </a></li>
-          {% endif %}
-          {% if perms.virtualization.add_virtualdisk %}
-            <li><a class="dropdown-item"  href="{% url 'virtualization:virtualdisk_add' %}?virtual_machine={{ object.pk }}&return_url={% url 'virtualization:virtualmachine_disks' pk=object.pk %}">
-              {% trans "Virtual Disks" %}
-            </a></li>
-          {% endif %}
+        {% if perms.virtualization.add_vminterface %}
+          <li><a class="dropdown-item"  href="{% url 'virtualization:vminterface_add' %}?virtual_machine={{ object.pk }}&return_url={% url 'virtualization:virtualmachine_interfaces' pk=object.pk %}">
+            {% trans "Interfaces" %}
+          </a></li>
+        {% endif %}
+        {% if perms.virtualization.add_virtualdisk %}
+          <li><a class="dropdown-item"  href="{% url 'virtualization:virtualdisk_add' %}?virtual_machine={{ object.pk }}&return_url={% url 'virtualization:virtualmachine_disks' pk=object.pk %}">
+            {% trans "Virtual Disks" %}
+          </a></li>
+        {% endif %}
       </ul>
-  </div>
-
+    </div>
+  {% endif %}
 {% endblock %}