starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Rack elevations display devices (and details of them) to users without permissions #3917

New Issue
Closed
opened 2025-12-29 18:32:04 +01:00 by adam · 3 comments
adam commented 2025-12-29 18:32:04 +01:00
Owner
Copy Link

Originally created by @cpmills1975 on GitHub (Jul 29, 2020).

Originally assigned to: @jeremystretch on GitHub.

Environment

  • Python version: 3.7.8
  • NetBox version: 2.9-beta1

Steps to Reproduce

  1. As admin (or user with adequate permissions) create two devices (device 'a' and device 'b') and rack them, device 'a' should have appropriate attributes such that it will be visible to user 'a' and the device 'b' should have appropriate attributes such that it will NOT be visible to user 'a'.
  2. Ensure permissions are created that limit user 'a' to see only device 'a' and not 'device b'
  3. Confirm, via the devices screen that user 'a' can see only device 'a' and not device 'b'
  4. View the rack elevations. Device 'b' will be visible and, when hovering over it, attributes will be displayed as normal in the tooltip, however clicking on it results in a 404 not found error, presumably, due to inadequate permissions.

Expected Behavior

While I get that displaying empty rack units doesn't make sense, some way to display occupied rack units but without any details of the device that are using them should be considered. Perhaps something similar to the rack reservation color coding. Alternatively blocking out the units, but displaying no details and either making sure they are not clickable, or if clicked result in a 403 forbidden result would be applicable.

Observed Behavior

Device 'b' is displayed to the user, along with serial number, asset number, role etc and when clicking it, a 404 is returned. The permissions model correctly prevents access to device 'b' when viewing the device list.

Originally created by @cpmills1975 on GitHub (Jul 29, 2020). Originally assigned to: @jeremystretch on GitHub. <!-- NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED. This form is only for reproducible bugs. If you need assistance with NetBox installation, or if you have a general question, DO NOT open an issue. Instead, post to our mailing list: https://groups.google.com/forum/#!forum/netbox-discuss Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report, and that any plugins have been disabled. --> ### Environment * Python version: 3.7.8 * NetBox version: 2.9-beta1 <!-- Describe in detail the exact steps that someone else can take to reproduce this bug using the current stable release of NetBox. Begin with the creation of any necessary database objects and call out every operation being performed explicitly. If reporting a bug in the REST API, be sure to reconstruct the raw HTTP request(s) being made: Don't rely on a client library such as pynetbox. --> ### Steps to Reproduce 1. As admin (or user with adequate permissions) create two devices (device 'a' and device 'b') and rack them, device 'a' should have appropriate attributes such that it will be visible to user 'a' and the device 'b' should have appropriate attributes such that it will NOT be visible to user 'a'. 2. Ensure permissions are created that limit user 'a' to see only device 'a' and not 'device b' 3. Confirm, via the devices screen that user 'a' can see only device 'a' and not device 'b' 4. View the rack elevations. Device 'b' will be visible and, when hovering over it, attributes will be displayed as normal in the tooltip, however clicking on it results in a 404 not found error, presumably, due to inadequate permissions. <!-- What did you expect to happen? --> ### Expected Behavior While I get that displaying empty rack units doesn't make sense, some way to display occupied rack units but without any details of the device that are using them should be considered. Perhaps something similar to the rack reservation color coding. Alternatively blocking out the units, but displaying no details and either making sure they are not clickable, or if clicked result in a 403 forbidden result would be applicable. <!-- What happened instead? --> ### Observed Behavior Device 'b' is displayed to the user, along with serial number, asset number, role etc and when clicking it, a 404 is returned. The permissions model correctly prevents access to device 'b' when viewing the device list.
adam added the type: bugstatus: acceptedbeta labels 2025-12-29 18:32:04 +01:00
adam closed this issue 2025-12-29 18:32:04 +01:00
adam commented 2025-12-29 18:32:04 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jul 29, 2020):

Good catch. Here's what it looks like with the fix in place. There are four 1U switches installed, and the current user has permission to view only the top two. The other devices are rendered only as unavailable space.

rack_screenshot

@jeremystretch commented on GitHub (Jul 29, 2020): Good catch. Here's what it looks like with the fix in place. There are four 1U switches installed, and the current user has permission to view only the top two. The other devices are rendered only as unavailable space. ![rack_screenshot](https://user-images.githubusercontent.com/13487278/88807998-52006c80-d180-11ea-9745-e7fc2a7852c3.png)
adam commented 2025-12-29 18:32:04 +01:00
Author
Owner
Copy Link

@cpmills1975 commented on GitHub (Aug 3, 2020):

This looks great @jeremystretch and having tested your latest commits, I can see the devices are indeed hidden. However, the API call for the rack elevation still exposes more information than one might reasonably expect including device ID, name and URL at /api/dcim/racks/id/elevation. Would you prefer a separate ticket opened for this?

@cpmills1975 commented on GitHub (Aug 3, 2020): This looks great @jeremystretch and having tested your latest commits, I can see the devices are indeed hidden. However, the API call for the rack elevation still exposes more information than one might reasonably expect including device ID, name and URL at /api/dcim/racks/id/elevation. Would you prefer a separate ticket opened for this?
adam commented 2025-12-29 18:32:05 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 3, 2020):

Good catch. I've opened #4940 to add an occupied field to each rack unit. This will allow us to indicate that a unit is occupied without revealing the specific device occupying it. The work to restrict the viewable devices will be done under that issue.

@jeremystretch commented on GitHub (Aug 3, 2020): Good catch. I've opened #4940 to add an `occupied` field to each rack unit. This will allow us to indicate that a unit is occupied without revealing the specific device occupying it. The work to restrict the viewable devices will be done under that issue.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label beta status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#3917
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?