starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-12 05:20:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permisson to view secrets does not work #2359

New Issue
Closed
opened 2025-12-29 17:25:15 +01:00 by adam · 4 comments
adam commented 2025-12-29 17:25:15 +01:00
Owner
Copy Link

Originally created by @marendres on GitHub (Feb 11, 2019).

Environment

  • Python version: 3.5.2
  • NetBox version: 2.5.5

Detailed Description

We are using secrets to store passwords and they are only available for users with the superuser flag. Normal users are not permitted to decrypt and view them, even if they have been granted all permissions (which should be the same as the superuser status). It is possible for normal users to create and delete secrets and also possible to strip them from those permissions, but they can not view them, even if they created the secret themselves.

Steps to Reproduce

  1. create secret
  2. login as user with permissions to view secrets, but no superuser
  3. try to open/display secret

decrypt and display the secret

"You do not have permission to decrypt this secret."

Originally created by @marendres on GitHub (Feb 11, 2019). ### Environment * Python version: 3.5.2 * NetBox version: 2.5.5 ### Detailed Description We are using secrets to store passwords and they are only available for users with the superuser flag. Normal users are not permitted to decrypt and view them, even if they have been granted all permissions (which should be the same as the superuser status). It is possible for normal users to create and delete secrets and also possible to strip them from those permissions, but they can not view them, even if they created the secret themselves. ### Steps to Reproduce 1. create secret 2. login as user with permissions to view secrets, but no superuser 3. try to open/display secret <!-- What did you expect to happen? --> decrypt and display the secret <!-- What happened instead? --> "You do not have permission to decrypt this secret."
adam closed this issue 2025-12-29 17:25:15 +01:00
adam commented 2025-12-29 17:25:16 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Feb 13, 2019):

The view permissions were introduced in Django 2.1 and are not yet used by NetBox. Please see the v2.5 release notes. The error message is displayed because the user does not have an active user key for decryption.

@jeremystretch commented on GitHub (Feb 13, 2019): The view permissions were introduced in Django 2.1 and are not yet used by NetBox. Please see the [v2.5 release notes](https://github.com/digitalocean/netbox/releases/tag/v2.5.0). The error message is displayed because the user does not have an active user key for decryption.
adam commented 2025-12-29 17:25:16 +01:00
Author
Owner
Copy Link

@apallier commented on GitHub (Dec 24, 2019):

Hi, I have the same issue with Netbox 2.6.6.

Behavior observed:

  • Only a superuser can decrypt password everywhere.
  • At "view" screen, a "normal" user can't decrypt even if her user key is active (gray "Unlock" button).
  • The only way for a "normal" user to see a secret is to go at the "editing" screen ("Edit this secret" button). Here, the password can be decrypted (green "Unlock" button).

Is it the expected behavior?

@apallier commented on GitHub (Dec 24, 2019): Hi, I have the same issue with Netbox 2.6.6. Behavior observed: - Only a superuser can decrypt password everywhere. - At "view" screen, a "normal" user can't decrypt even if her user key is active (gray "Unlock" button). - The only way for a "normal" user to see a secret is to go at the "editing" screen ("Edit this secret" button). Here, the password can be decrypted (green "Unlock" button). Is it the expected behavior?
adam commented 2025-12-29 17:25:17 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Dec 24, 2019):

First, upgrade to the latest stable

Second, if you experience the same issue, provide reproducible steps here for us to follow. If it is a slightly different issues please open a new issue following one of the templates

@DanSheps commented on GitHub (Dec 24, 2019): First, upgrade to the latest stable Second, if you experience the same issue, provide reproducible steps here for us to follow. If it is a slightly different issues please open a new issue following one of the templates
adam commented 2025-12-29 17:25:17 +01:00
Author
Owner
Copy Link

@marendres commented on GitHub (Feb 10, 2020):

Upgraded to the latest stable version (2.7.4) but the problem still persists. It is the same problem @apallier seems to have. A user can have all permissions but is not able to decrypt secrets in the device overview, only in the editing screen of the secret itself.
On the device overview the "Unlock" is grey and there is an alttext "Permission denied" if you hoover over it.

@marendres commented on GitHub (Feb 10, 2020): Upgraded to the latest stable version (2.7.4) but the problem still persists. It is the same problem @apallier seems to have. A user can have all permissions but is not able to decrypt secrets in the device overview, only in the editing screen of the secret itself. On the device overview the "Unlock" is grey and there is an alttext "Permission denied" if you hoover over it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2359
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?