starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

GraphQL related objects are not properly restricted #10157

New Issue
Closed
opened 2025-12-29 21:27:36 +01:00 by adam · 1 comment
adam commented 2025-12-29 21:27:36 +01:00
Owner
Copy Link

Originally created by @DanSheps on GitHub (Aug 29, 2024).

Originally assigned to: @DanSheps on GitHub.

Deployment Type

NetBox Cloud

NetBox Version

v4.0.10

Python Version

3.12

Steps to Reproduce

  1. Create a site
  2. Create an ASN in the site (Ex: 64511, pk=1)
  3. Create a user with permissions to only view ASN's (not sites)
  4. Run the following GQL: { asn(id: 1) { id, sites {} } }

Expected Behavior

Will show the ASN but not the related site

Observed Behavior

Related site is shown

Originally created by @DanSheps on GitHub (Aug 29, 2024). Originally assigned to: @DanSheps on GitHub. ### Deployment Type NetBox Cloud ### NetBox Version v4.0.10 ### Python Version 3.12 ### Steps to Reproduce 1. Create a site 2. Create an ASN in the site (Ex: 64511, pk=1) 3. Create a user with permissions to only view ASN's (not sites) 4. Run the following GQL: `{ asn(id: 1) { id, sites {} } }` ### Expected Behavior Will show the ASN but not the related site ### Observed Behavior Related site is shown
adam added the type: bugstatus: acceptedseverity: high labels 2025-12-29 21:27:36 +01:00
adam closed this issue 2025-12-29 21:27:36 +01:00
adam commented 2025-12-29 21:27:37 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Aug 29, 2024):

Credit to Jeremy for actually finding this bug when testing the GraphQL PR.

@DanSheps commented on GitHub (Aug 29, 2024): Credit to Jeremy for actually finding this bug when testing the GraphQL PR.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label severity: high status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#10157
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?