starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

extras.view_reportresult permission does not grant viewing rights on reports #4105

New Issue
Closed
opened 2025-12-29 18:33:09 +01:00 by adam · 6 comments
adam commented 2025-12-29 18:33:09 +01:00
Owner
Copy Link

Originally created by @mobarre on GitHub (Sep 16, 2020).

Originally assigned to: @jeremystretch on GitHub.

Environment

  • Python version: 3.6.9
  • NetBox version: 2.9.3

Steps to Reproduce

  1. Create a new user
  2. Assign it the extras.view_reportresult permission (or assign it to a group that has this permission)
  3. Log as this new user
  4. Attempt to access the report section
  5. Attempt to access the result page of a report

Expected Behavior

I would expect this user to be able to browse the list of available reports and look at their results

Observed Behavior

Attempts to access the report section results in an Access Denied
Attempts to access the result page of a report (with URL) directly also results in an Access Denied

Originally created by @mobarre on GitHub (Sep 16, 2020). Originally assigned to: @jeremystretch on GitHub. ### Environment * Python version: 3.6.9 * NetBox version: 2.9.3 ### Steps to Reproduce 1. Create a new user 2. Assign it the extras.view_reportresult permission (or assign it to a group that has this permission) 3. Log as this new user 4. Attempt to access the report section 5. Attempt to access the result page of a report ### Expected Behavior I would expect this user to be able to browse the list of available reports and look at their results ### Observed Behavior Attempts to access the report section results in an Access Denied Attempts to access the result page of a report (with URL) directly also results in an Access Denied
adam added the type: bugstatus: accepted labels 2025-12-29 18:33:09 +01:00
adam closed this issue 2025-12-29 18:33:09 +01:00
adam commented 2025-12-29 18:33:10 +01:00
Author
Owner
Copy Link

@ledgley commented on GitHub (Sep 17, 2020):

Also have the same issue described, plus the same issue with Scripts. Though I can 'read' the script, I get 'You do not have permission to run scripts' regardless of the permissions given.

@ledgley commented on GitHub (Sep 17, 2020): Also have the same issue described, plus the same issue with Scripts. Though I can 'read' the script, I get 'You do not have permission to run scripts' regardless of the permissions given.
adam commented 2025-12-29 18:33:10 +01:00
Author
Owner
Copy Link

@ledgley commented on GitHub (Sep 17, 2020):

To add to the above, I have tried with LDAP users and local users. Only Superusers are able to perform the actions described.

@ledgley commented on GitHub (Sep 17, 2020): To add to the above, I have tried with LDAP users and local users. Only Superusers are able to perform the actions described.
adam commented 2025-12-29 18:33:10 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 23, 2020):

Attempts to access the report section results in an Access Denied

I cannot replicate this behavior on v2.9.3. Logged in as a user with the extras.view_reportresult permission, I am able to view the reports list and individual reports. It is only the report results that return a permission denied error.

Also have the same issue described, plus the same issue with Scripts.

@ledgley different issue. Scripts require the extras.view_script permission.

@jeremystretch commented on GitHub (Sep 23, 2020): > Attempts to access the report section results in an Access Denied I cannot replicate this behavior on v2.9.3. Logged in as a user with the `extras.view_reportresult` permission, I am able to view the reports list and individual reports. It is only the report results that return a permission denied error. > Also have the same issue described, plus the same issue with Scripts. @ledgley different issue. Scripts require the `extras.view_script` permission.
adam commented 2025-12-29 18:33:10 +01:00
Author
Owner
Copy Link

@mobarre commented on GitHub (Sep 23, 2020):

Could this be due to the migration script moving from the old permission system to the new ? (although I doubt it can be as I tested with a newly created user and newly created groups too).

@mobarre commented on GitHub (Sep 23, 2020): Could this be due to the migration script moving from the old permission system to the new ? (although I doubt it can be as I tested with a newly created user and newly created groups too).
adam commented 2025-12-29 18:33:10 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 23, 2020):

@mobarre Nah, it's just a bug in the view. The view is looking for extras.view_report as opposed to extras.view_reportresult. I'll fix this for v2.9.x, however note that we're currently planning to merge reports into scripts for v2.10 (see #4735).

@jeremystretch commented on GitHub (Sep 23, 2020): @mobarre Nah, it's just a bug in the view. The view is looking for `extras.view_report` as opposed to `extras.view_reportresult`. I'll fix this for v2.9.x, however note that we're currently planning to merge reports into scripts for v2.10 (see #4735).
adam commented 2025-12-29 18:33:10 +01:00
Author
Owner
Copy Link

@rebortg commented on GitHub (Sep 23, 2020):

i say here this is the case but i was confused and the PR c0b94e4e8e don't fix this issue.
i try it at the moment with the current develop branch.
The correct permission string must be extras.view_report not extras.view_reportresult
reportresult shouldn't be there as a contenttype i bet if one of you, who can set this permission, a python manage.py remove_stale_contenttypes will remove this contenttype.

on a fresh 2.9.3 this are the list of contenttypes in the DB:

>>> from django.contrib.contenttypes.models import ContentType
>>> for c in ContentType.objects.filter(app_label='extras'):
...     c
...
<ContentType: extras | report>
<ContentType: extras | export template>
<ContentType: extras | graph>
<ContentType: extras | custom field>
<ContentType: extras | custom field choice>
<ContentType: extras | custom field value>
<ContentType: extras | image attachment>
<ContentType: extras | webhook>
<ContentType: extras | object change>
<ContentType: extras | config context>
<ContentType: extras | tag>
<ContentType: extras | tagged item>
<ContentType: extras | custom link>
<ContentType: extras | script>
<ContentType: extras | job result>```
@rebortg commented on GitHub (Sep 23, 2020): i say [here](https://github.com/netbox-community/netbox/issues/5066) this is the case but i was confused and the PR https://github.com/netbox-community/netbox/commit/c0b94e4e8e861c0287e1a45be95211d1ec50e78a don't fix this issue. i try it at the moment with the current develop branch. The correct permission string must be `extras.view_report` not `extras.view_reportresult` `reportresult` shouldn't be there as a contenttype i bet if one of you, who can set this permission, a `python manage.py remove_stale_contenttypes` will remove this contenttype. on a fresh 2.9.3 this are the list of contenttypes in the DB: ```python manage.py nbshell >>> from django.contrib.contenttypes.models import ContentType >>> for c in ContentType.objects.filter(app_label='extras'): ... c ... <ContentType: extras | report> <ContentType: extras | export template> <ContentType: extras | graph> <ContentType: extras | custom field> <ContentType: extras | custom field choice> <ContentType: extras | custom field value> <ContentType: extras | image attachment> <ContentType: extras | webhook> <ContentType: extras | object change> <ContentType: extras | config context> <ContentType: extras | tag> <ContentType: extras | tagged item> <ContentType: extras | custom link> <ContentType: extras | script> <ContentType: extras | job result>```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4105
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?