starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

[PR #15251] [CLOSED] Fixes: #14634 - Bypass Write permissions for render endpoint #14564

New Issue
Closed
opened 2025-12-29 23:25:13 +01:00 by adam · 0 comments
adam commented 2025-12-29 23:25:13 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/15251
Author: @DanSheps
Created: 2/23/2024
Status: ❌ Closed

Base: develop ← Head: 14634-override_render_permissions

📝 Commits (10+)

  • 7600adc Allow bypass of "write" permission for render endpoint.
  • c596194 Fix tests
  • adca617 Fix mistake with QS swapping
  • dc7a4be Merge branch 'develop' of https://github.com/netbox-community/netbox into 14634-override_render_permissions
  • 9e4ee29 Update for more reusable code
  • 542fa71 Change class name, call get_action() only and remove excess code
  • 67b6857 Fix issue with tests. Reverted to overriding the permissions map as the only viable option
  • ed3f084 Remove old HTTP_ACTIONS constant
  • 3878674 Add override for read_only tokens to be used with an overriden permission set
  • 725db7b Override has_permission and has_object_permission

📊 Changes

6 files changed (+50 additions, -17 deletions)

View changed files

📝 netbox/dcim/tests/test_api.py (+1 -1)
📝 netbox/extras/api/mixins.py (+5 -1)
📝 netbox/netbox/api/authentication.py (+35 -1)
📝 netbox/netbox/api/viewsets/__init__.py (+3 -12)
📝 netbox/utilities/permissions.py (+5 -1)
📝 netbox/virtualization/tests/test_api.py (+1 -1)

📄 Description

Fixes: #14634 - Bypass Write permissions for render endpoint

  • Bypass permission for render endpoint by swapping the permissions map and overriding the restrict() action.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/15251 **Author:** [@DanSheps](https://github.com/DanSheps) **Created:** 2/23/2024 **Status:** ❌ Closed **Base:** `develop` ← **Head:** `14634-override_render_permissions` --- ### 📝 Commits (10+) - [`7600adc`](https://github.com/netbox-community/netbox/commit/7600adc1e131ab3425e95f0b603058f0fbe18dc4) Allow bypass of "write" permission for render endpoint. - [`c596194`](https://github.com/netbox-community/netbox/commit/c59619438748d20cf8c119173c5f04286cb8ad60) Fix tests - [`adca617`](https://github.com/netbox-community/netbox/commit/adca61736907d4769ec734beafcef0423fed3e49) Fix mistake with QS swapping - [`dc7a4be`](https://github.com/netbox-community/netbox/commit/dc7a4be91d890ff85c5baef4ea5c295f74d801c0) Merge branch 'develop' of https://github.com/netbox-community/netbox into 14634-override_render_permissions - [`9e4ee29`](https://github.com/netbox-community/netbox/commit/9e4ee2960563a91cfe74241a06b0851b8e905746) Update for more reusable code - [`542fa71`](https://github.com/netbox-community/netbox/commit/542fa71267670f2b8919e926232786e73471acbe) Change class name, call get_action() only and remove excess code - [`67b6857`](https://github.com/netbox-community/netbox/commit/67b68577450590844640acbab68bde26ee663cd9) Fix issue with tests. Reverted to overriding the permissions map as the only viable option - [`ed3f084`](https://github.com/netbox-community/netbox/commit/ed3f0846d3f7d913c18700067aca328b6159f10b) Remove old `HTTP_ACTIONS` constant - [`3878674`](https://github.com/netbox-community/netbox/commit/38786748b7012f61b16277bf6f66d1a98aa2d64e) Add override for read_only tokens to be used with an overriden permission set - [`725db7b`](https://github.com/netbox-community/netbox/commit/725db7b16ed1e343a8a406359681b464376fb198) Override has_permission and has_object_permission ### 📊 Changes **6 files changed** (+50 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `netbox/dcim/tests/test_api.py` (+1 -1) 📝 `netbox/extras/api/mixins.py` (+5 -1) 📝 `netbox/netbox/api/authentication.py` (+35 -1) 📝 `netbox/netbox/api/viewsets/__init__.py` (+3 -12) 📝 `netbox/utilities/permissions.py` (+5 -1) 📝 `netbox/virtualization/tests/test_api.py` (+1 -1) </details> ### 📄 Description ### Fixes: #14634 - Bypass Write permissions for render endpoint * Bypass permission for render endpoint by swapping the permissions map and overriding the restrict() action. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 23:25:13 +01:00
adam closed this issue 2025-12-29 23:25:13 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#14564
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?