[PR #15704] [MERGED] 15582 check permissions on specific object when sync request #14649

New Issue

adam · 2025-12-29T23:25:44+01:00

adam commented

2025-12-29 23:25:44 +01:00

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/15704
Author: @arthanson
Created: 4/11/2024
Status: ✅ Merged
Merged: 4/17/2024
Merged by: @jeremystretch

Base: develop ← Head: 15582-sync-perm

📝 Commits (3)

1449cda 15582 check permissions on specific object when sync request
3f19be8 15582 move permission check
7fcb28b Enable translation of error message

📊 Changes

1 file changed (+5 additions, -4 deletions)

View changed files

📝 netbox/core/api/views.py (+5 -4)

📄 Description

Fixes: #15582

Check permissions on specific object when sync request. I kept the original permission check as that is before the object is loaded and the get_object_or_404 can return 404 if the object doesn't exist and the user doesn't have sync permission which is a security edge case of showing which ones exist.

Once the object is actually loaded it needs to be re-checked in case there are constraints or perms tied to the specific object.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/15704 **Author:** [@arthanson](https://github.com/arthanson) **Created:** 4/11/2024 **Status:** ✅ Merged **Merged:** 4/17/2024 **Merged by:** [@jeremystretch](https://github.com/jeremystretch) **Base:** `develop` ← **Head:** `15582-sync-perm` --- ### 📝 Commits (3) - [`1449cda`](https://github.com/netbox-community/netbox/commit/1449cda390f5488b51ac3699c3c6a4f2d8e9cdd0) 15582 check permissions on specific object when sync request - [`3f19be8`](https://github.com/netbox-community/netbox/commit/3f19be86078e6c6ffcfa552792263bbc362e39ac) 15582 move permission check - [`7fcb28b`](https://github.com/netbox-community/netbox/commit/7fcb28b60b3fefacd539f422f014e323dfc04e03) Enable translation of error message ### 📊 Changes **1 file changed** (+5 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `netbox/core/api/views.py` (+5 -4) </details> ### 📄 Description ### Fixes: #15582 Check permissions on specific object when sync request. I kept the original permission check as that is before the object is loaded and the get_object_or_404 can return 404 if the object doesn't exist and the user doesn't have sync permission which is a security edge case of showing which ones exist. Once the object is actually loaded it needs to be re-checked in case there are constraints or perms tied to the specific object. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

adam added the pull-request label 2025-12-29 23:25:44 +01:00

adam closed this issue

2025-12-29 23:25:45 +01:00

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#14649