Do not display scripts in the scripts list view if the user does not have permission to view them #11680

New Issue

adam · 2025-12-29T21:48:33+01:00

adam commented

2025-12-29 21:48:33 +01:00

Originally created by @atownson on GitHub (Oct 3, 2025).

Originally assigned to: @bctiemann on GitHub.

NetBox version

v4.4.2

Feature type

New functionality

Proposed functionality

Currently, if you add a permission constraint to the Script model limiting the scripts a user can view, the script is still displayed in the list view and returns a 404 when the hyperlink is clicked. I'm proposing to add a permissions check when rendering the scripts list view that will only display the scripts a user has permission to view. This should be able to be accomplished by adding a permissions check in the script_list_content.html template.

Example Script model permission constraint:

{
  "name__in": [
    "MyScript",
    "YourScript"
  ]
}

Use case

Limiting the scripts in the list view based on permissions would improve the use experience by consolidating the scripts within the list and preventing 404 responses when the hyperlinks are clicked.

Database changes

None

External dependencies

None

Originally created by @atownson on GitHub (Oct 3, 2025). Originally assigned to: @bctiemann on GitHub. ### NetBox version v4.4.2 ### Feature type New functionality ### Proposed functionality Currently, if you add a permission constraint to the `Script` model limiting the scripts a user can view, the script is still displayed in the list view and returns a 404 when the hyperlink is clicked. I'm proposing to add a permissions check when rendering the scripts list view that will only display the scripts a user has permission to view. This should be able to be accomplished by adding a permissions check in the [script_list_content.html](https://github.com/netbox-community/netbox/blob/main/netbox/templates/extras/inc/script_list_content.html) template. Example `Script` model permission constraint: ``` { "name__in": [ "MyScript", "YourScript" ] } ``` ### Use case Limiting the scripts in the list view based on permissions would improve the use experience by consolidating the scripts within the list and preventing 404 responses when the hyperlinks are clicked. ### Database changes None ### External dependencies None

adam added the type: bug status: accepted netbox severity: low labels 2025-12-29 21:48:33 +01:00

adam commented

2025-12-29 21:48:35 +01:00

@atownson commented on GitHub (Oct 3, 2025):

Another note: The permissions check in the ScriptListView class is scoped to ScriptModule instead of Script. This works as expected to limit the modules rendered in the script list view (i.e. if you add a permissions constraint to the ManagedFile model, the constraint is enforced and the module is not rendered in the list view). This issue proposes to add a second permissions check for each script.

@atownson commented on GitHub (Oct 3, 2025): Another note: The permissions check in the `ScriptListView` class is scoped to `ScriptModule` instead of `Script`. This works as expected to limit the modules rendered in the script list view (i.e. if you add a permissions constraint to the `ManagedFile` model, the constraint is enforced and the module is not rendered in the list view). This issue proposes to add a second permissions check for each script.

adam commented

2025-12-29 21:48:35 +01:00

@jnovinger commented on GitHub (Nov 3, 2025):

I've gone back and forth on this a few times and ultimately I think this is actually a bug.

@jnovinger commented on GitHub (Nov 3, 2025): I've gone back and forth on this a few times and ultimately I think this is actually a bug.

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#11680