starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Make current user available in Custom Scripts #3024

New Issue
Closed
opened 2025-12-29 18:24:51 +01:00 by adam · 2 comments
adam commented 2025-12-29 18:24:51 +01:00
Owner
Copy Link

Originally created by @2bithacker on GitHub (Nov 21, 2019).

Environment

  • Python version: 3.6.8
  • NetBox version: 2.6.7

Proposed Functionality

Make the currently logged in user available to Custom Scripts. It may be beneficial to make the entire request context available, but all I need currently is the user.

Use Case

In my use case, we have a policy of commenting on Prefixes with the user who allocated and assigned the prefix to a site. I'm attempting to automate this process using a Custom Script, but currently need to ask the user for their username, despite them being logged in.

Database Changes

None

External Dependencies

None

Originally created by @2bithacker on GitHub (Nov 21, 2019). <!-- NOTE: This form is only for proposing specific new features or enhancements. If you have a general idea or question, please post to our mailing list instead of opening an issue: https://groups.google.com/forum/#!forum/netbox-discuss NOTE: Due to an excessive backlog of feature requests, we are not currently accepting any proposals which significantly extend NetBox's feature scope. Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report. --> ### Environment * Python version: 3.6.8 * NetBox version: 2.6.7 <!-- Describe in detail the new functionality you are proposing. Include any specific changes to work flows, data models, or the user interface. --> ### Proposed Functionality Make the currently logged in user available to Custom Scripts. It may be beneficial to make the entire `request` context available, but all I need currently is the user. <!-- Convey an example use case for your proposed feature. Write from the perspective of a NetBox user who would benefit from the proposed functionality and describe how. ---> ### Use Case In my use case, we have a policy of commenting on Prefixes with the user who allocated and assigned the prefix to a site. I'm attempting to automate this process using a Custom Script, but currently need to ask the user for their username, despite them being logged in. <!-- Note any changes to the database schema necessary to support the new feature. For example, does the proposal require adding a new model or field? (Not all new features require database changes.) ---> ### Database Changes None <!-- List any new dependencies on external libraries or services that this new feature would introduce. For example, does the proposal require the installation of a new Python package? (Not all new features introduce new dependencies.) --> ### External Dependencies None
adam added the status: acceptedtype: feature labels 2025-12-29 18:24:51 +01:00
adam closed this issue 2025-12-29 18:24:51 +01:00
adam commented 2025-12-29 18:24:52 +01:00
Author
Owner
Copy Link

@hellerve commented on GitHub (Nov 21, 2019):

I’m not personally using that kind of context, so I can’t say much, but I do think that spending a minute to think about what properties of the request context might make sense to be shared might be worthwhile.

I don’t think that sharing the whole request is necessarily a good idea. While I think custom scripts are inherently trusted, there is just no need to expose the session, for instance. This might seem ridiculous (because the script already has access to Python and its capabilities anyway), but I think that it actually makes sense to not expose those bits of “sensitive” information anyway.

@hellerve commented on GitHub (Nov 21, 2019): I’m not personally using that kind of context, so I can’t say much, but I do think that spending a minute to think about what properties of the request context might make sense to be shared might be worthwhile. I don’t think that sharing the whole request is necessarily a good idea. While I think custom scripts are inherently trusted, there is just no need to expose the `session`, for instance. This might seem ridiculous (because the script already has access to Python and its capabilities anyway), but I think that it actually makes sense to not expose those bits of “sensitive” information anyway.
adam commented 2025-12-29 18:24:52 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Dec 6, 2019):

@hellerve While I appreciate the security consciousness, I don't think there's anything in the request context that could be considered more privileged than the access already given to a script (which is essentially everything). Given that a custom script can already do things like create users and reset passwords, providing access to the session ID and other request parameters isn't much of a concern.

@jeremystretch commented on GitHub (Dec 6, 2019): @hellerve While I appreciate the security consciousness, I don't think there's anything in the request context that could be considered more privileged than the access already given to a script (which is essentially everything). Given that a custom script can already do things like create users and reset passwords, providing access to the session ID and other request parameters isn't much of a concern.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#3024
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?