Non Staff User Unable to delete devices #407

New Issue

adam · 2025-12-29T16:21:44+01:00

adam commented

2025-12-29 16:21:44 +01:00

Originally created by @dsolson1 on GitHub (Aug 31, 2016).

I have a user configured with security configured as "Active" and "Superuser Status" but not "Staff Status".

When this user tries to delete a device they get an error:
"You are authenticated as <username>, but are not authorized to access this page. Would you like to login to a different account?"

I have also tried to assign all user permissions without checking the "Staff Status"box and that still fails.

My goal is to have operational users accounts that can perform all of the functions but not access the Admin site.

Any suggestions?

Originally created by @dsolson1 on GitHub (Aug 31, 2016). I have a user configured with security configured as "Active" and "Superuser Status" but not "Staff Status". When this user tries to delete a device they get an error: "You are authenticated as <username>, but are not authorized to access this page. Would you like to login to a different account?" I have also tried to assign all user permissions without checking the "Staff Status"box and that still fails. My goal is to have operational users accounts that can perform all of the functions but not access the Admin site. Any suggestions?

adam added the type: bug label 2025-12-29 16:21:44 +01:00

adam closed this issue

2025-12-29 16:21:44 +01:00

adam commented

2025-12-29 16:21:44 +01:00

@jeremystretch commented on GitHub (Sep 1, 2016):

Superusers have all permissions implicitly. Staff status merely controls access to the admin UI. How are you attempting to delete a device?

@jeremystretch commented on GitHub (Sep 1, 2016): Superusers have all permissions implicitly. Staff status merely controls access to the admin UI. How are you attempting to delete a device?

adam commented

2025-12-29 16:21:45 +01:00

@dsolson1 commented on GitHub (Sep 1, 2016):

From the main page,
Devices -> check box in front of desired device -> Press "Delete Selected" at bottom of page -> Check Confirm box and "Confirm" button.

Then Error msg comes up.

I'm not sure why by not having the "Staff Status" checked this error would come up. Like you said, "Superuser Status" should imply all permissions within the app.

Forgot to mention that I'm running 1.5.2.

@dsolson1 commented on GitHub (Sep 1, 2016): From the main page, Devices -> check box in front of desired device -> Press "Delete Selected" at bottom of page -> Check Confirm box and "Confirm" button. Then Error msg comes up. I'm not sure why by not having the "Staff Status" checked this error would come up. Like you said, "Superuser Status" should imply all permissions within the app. Forgot to mention that I'm running 1.5.2.

adam commented

2025-12-29 16:21:45 +01:00

@jeremystretch commented on GitHub (Sep 12, 2016):

The cause of this bug was a bit of old code that's no longer needed:

@method_decorator(staff_member_required)
def dispatch(self, *args, **kwargs):
    return super(BulkDeleteView, self).dispatch(*args, **kwargs)

staff_member_required was used at some point in early development, prior to the introduction of PermissionRequiredMixin in Django 1.9, which all views now use.

@jeremystretch commented on GitHub (Sep 12, 2016): The cause of this bug was a bit of old code that's no longer needed: ``` @method_decorator(staff_member_required) def dispatch(self, *args, **kwargs): return super(BulkDeleteView, self).dispatch(*args, **kwargs) ``` `staff_member_required` was used at some point in early development, prior to the introduction of `PermissionRequiredMixin` in Django 1.9, which all views now use.

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#407