starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

[PR #20975] [MERGED] Fixes #20929: Require render_config permission for UI config rendering #16106

New Issue
Closed
opened 2025-12-30 00:25:50 +01:00 by adam · 0 comments
adam commented 2025-12-30 00:25:50 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/20975
Author: @jnovinger
Created: 12/12/2025
Status: ✅ Merged
Merged: 12/16/2025
Merged by: @jeremystretch

Base: feature ← Head: 20929-render-config-perm-UI

📝 Commits (3)

  • e81e192 Closes #20929: Require render_config permission for UI config rendering
  • 4cf0a10 Address PR feedback
  • 68ec84f Address PR feedback

📊 Changes

5 files changed (+58 additions, -0 deletions)

View changed files

📝 netbox/dcim/tests/test_views.py (+23 -0)
📝 netbox/dcim/views.py (+1 -0)
📝 netbox/utilities/testing/base.py (+10 -0)
📝 netbox/virtualization/tests/test_views.py (+23 -0)
📝 netbox/virtualization/views.py (+1 -0)

📄 Description

Fixes: #20929

  • Modified ObjectRenderConfigView.has_permission() to require both view and render_config permissions
  • Added remove_permissions() test helper to remove permissions from existing ObjectPermission objects
  • Added regression tests for Device and VirtualMachine render-config permission enforcement

The render_config permission action was introduced in #16681 for API endpoints. This extends PR_7604_description to the UI render-config tabs, preventing users from viewing rendered configurations without explicit permission.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/20975 **Author:** [@jnovinger](https://github.com/jnovinger) **Created:** 12/12/2025 **Status:** ✅ Merged **Merged:** 12/16/2025 **Merged by:** [@jeremystretch](https://github.com/jeremystretch) **Base:** `feature` ← **Head:** `20929-render-config-perm-UI` --- ### 📝 Commits (3) - [`e81e192`](https://github.com/netbox-community/netbox/commit/e81e192d2e30e7be66aea92955a2828151e488a1) Closes #20929: Require render_config permission for UI config rendering - [`4cf0a10`](https://github.com/netbox-community/netbox/commit/4cf0a1045c266a41a009b54861bd92cae95fb048) Address PR feedback - [`68ec84f`](https://github.com/netbox-community/netbox/commit/68ec84ff70b33ba5e573a9d3f38e14d602c11a3b) Address PR feedback ### 📊 Changes **5 files changed** (+58 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `netbox/dcim/tests/test_views.py` (+23 -0) 📝 `netbox/dcim/views.py` (+1 -0) 📝 `netbox/utilities/testing/base.py` (+10 -0) 📝 `netbox/virtualization/tests/test_views.py` (+23 -0) 📝 `netbox/virtualization/views.py` (+1 -0) </details> ### 📄 Description ### Fixes: #20929 - Modified `ObjectRenderConfigView.has_permission()` to require both view and render_config permissions - Added `remove_permissions()` test helper to remove permissions from existing ObjectPermission objects - Added regression tests for Device and VirtualMachine render-config permission enforcement The `render_config` permission action was introduced in #16681 for API endpoints. This extends PR_7604_description to the UI render-config tabs, preventing users from viewing rendered configurations without explicit permission. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-30 00:25:50 +01:00
adam closed this issue 2025-12-30 00:25:51 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#16106
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?