starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

API Endpoint /api/extras/scripts/ Exposes Script Metadata to Users Without Permissions #11763

New Issue
Closed
opened 2025-12-29 21:49:36 +01:00 by adam · 0 comments
adam commented 2025-12-29 21:49:36 +01:00
Owner
Copy Link

Originally created by @joro770 on GitHub (Oct 21, 2025).

Originally assigned to: @jeremystretch on GitHub.

NetBox Edition

NetBox Community

NetBox Version

v4.4.4

Python Version

3.12

Steps to Reproduce

  1. Create a standard user account without any extras or scripts permissions.
  2. Generate an API token for this user.
  3. Attempt to view the list of scripts via the UI at /extras/scripts/ → The user correctly sees no scripts.
  4. Use the same API token to perform a GET request to /api/extras/scripts/ (or a specific script at /api/extras/scripts/{id}/).
  5. Observe that the script details (name, module, variable definitions, and job results) are returned successfully via the API.
  6. Attempt to execute the script (POST request) via the API — this correctly returns a permission error (“This user does not have permission to run scripts.”).

Expected Behavior

When a user does not have permission to view or execute scripts, both the UI and API should hide scripts entirely.
The API /api/extras/scripts/ endpoint should return a permission error for such users, just like the ScriptListView does in the UI.

Observed Behavior

  • The user cannot see any scripts in the UI, which is correct.
Image
  • However, the same user can access script metadata and historical execution results through the API by calling /api/extras/scripts/.
  • The API response includes full script details (name, module, variable schema, and completed job logs), even though the user has no extras or scripts permissions.
Image
  • Execution attempts are correctly denied.
Image
Originally created by @joro770 on GitHub (Oct 21, 2025). Originally assigned to: @jeremystretch on GitHub. ### NetBox Edition NetBox Community ### NetBox Version v4.4.4 ### Python Version 3.12 ### Steps to Reproduce 1. Create a standard user account without any extras or scripts permissions. 2. Generate an API token for this user. 3. Attempt to view the list of scripts via the UI at /extras/scripts/ → The user correctly sees no scripts. 4. Use the same API token to perform a GET request to /api/extras/scripts/ (or a specific script at /api/extras/scripts/{id}/). 5. Observe that the script details (name, module, variable definitions, and job results) are returned successfully via the API. 6. Attempt to execute the script (POST request) via the API — this correctly returns a permission error (“This user does not have permission to run scripts.”). ### Expected Behavior When a user does not have permission to view or execute scripts, both the UI and API should hide scripts entirely. The API /api/extras/scripts/ endpoint should return a permission error for such users, just like the ScriptListView does in the UI. ### Observed Behavior - The user cannot see any scripts in the UI, which is correct. <img width="1472" height="527" alt="Image" src="https://github.com/user-attachments/assets/ef9a63bd-38e9-4b7a-b5b4-dd68b281469b" /> - However, the same user can access script metadata and historical execution results through the API by calling /api/extras/scripts/. - The API response includes full script details (name, module, variable schema, and completed job logs), even though the user has no extras or scripts permissions. <img width="1461" height="1502" alt="Image" src="https://github.com/user-attachments/assets/97d4dd85-dbe6-4575-b8fd-477ef2569589" /> - Execution attempts are correctly denied. <img width="1700" height="1377" alt="Image" src="https://github.com/user-attachments/assets/f9d4dab2-aa83-4d86-b2d6-955db257e6dc" />
adam added the type: bugstatus: acceptednetboxseverity: low labels 2025-12-29 21:49:36 +01:00
adam closed this issue 2025-12-29 21:49:36 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label netbox severity: low status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#11763
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?