starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permissions constraints are not (adequately) applied on cable traces #4492

New Issue
Closed
opened 2025-12-29 18:36:36 +01:00 by adam · 1 comment
adam commented 2025-12-29 18:36:36 +01:00
Owner
Copy Link

Originally created by @cpmills1975 on GitHub (Jan 26, 2021).

Environment

  • Python version: 3.9
  • NetBox version: 2.10.3

Steps to Reproduce

  1. As a user with sufficient permissions, create two devices (device a and device b)
  2. Create an interface on each (interface a1 and b1)
  3. Link the two interfaces with a cable
  4. Create a permissions rule that allows access to another test user to only one of the interfaces (restricting ID with a constraint such as { "id": } is sufficient)
  5. Ensure no other permissions are granted - i.e. the test user cannot see the cables, devices, any other interfaces, front/rear ports etc
  6. browse to /dcim/interfaces/<permitted_id>/trace/

Expected Behavior

A lot less information be presented than is!

Observed Behavior

It appears to me that the only permission that impacts the cable trace is permission to view the interface that the trace is originating from. No permissions are required to the cable or to any device/interface/front/rear port in the chain yet they are all shown. While the permissions setup specified above is bizarre, it serves the purpose in that the entire cable trace is visible as are all the devices, interfaces/front/rear ports etc in the cable path exposing a lot more information than one might reasonably deem necessary or acceptable.

Ideally the user should need permission to view all the elements presented on the cable path with any permission missing being rendered in some suitable way to obscure the information. I'm not quite sure how far this should go, i.e. should devices to which no view permission is still be shown in some obscured way or should they be skipped and a dotted line shown between the two interfaces that do have permissions or perhaps the trace functionality should only work if permissions are granted all the way down the chain?

Originally created by @cpmills1975 on GitHub (Jan 26, 2021). <!-- NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED. This form is only for reporting reproducible bugs. If you need assistance with NetBox installation, or if you have a general question, please start a discussion instead: https://github.com/netbox-community/netbox/discussions Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report, and that any plugins have been disabled. --> ### Environment * Python version: 3.9 * NetBox version: 2.10.3 <!-- Describe in detail the exact steps that someone else can take to reproduce this bug using the current stable release of NetBox. Begin with the creation of any necessary database objects and call out every operation being performed explicitly. If reporting a bug in the REST API, be sure to reconstruct the raw HTTP request(s) being made: Don't rely on a client library such as pynetbox. --> ### Steps to Reproduce 1. As a user with sufficient permissions, create two devices (device a and device b) 2. Create an interface on each (interface a1 and b1) 3. Link the two interfaces with a cable 4. Create a permissions rule that allows access to another test user to only one of the interfaces (restricting ID with a constraint such as { "id": <id> } is sufficient) 5. Ensure no other permissions are granted - i.e. the test user cannot see the cables, devices, any other interfaces, front/rear ports etc 6. browse to /dcim/interfaces/<permitted_id>/trace/ <!-- What did you expect to happen? --> ### Expected Behavior A lot less information be presented than is! <!-- What happened instead? --> ### Observed Behavior It appears to me that the only permission that impacts the cable trace is permission to view the interface that the trace is originating from. No permissions are required to the cable or to any device/interface/front/rear port in the chain yet they are all shown. While the permissions setup specified above is bizarre, it serves the purpose in that the entire cable trace is visible as are all the devices, interfaces/front/rear ports etc in the cable path exposing a lot more information than one might reasonably deem necessary or acceptable. Ideally the user should need permission to view all the elements presented on the cable path with any permission missing being rendered in some suitable way to obscure the information. I'm not quite sure how far this should go, i.e. should devices to which no view permission is still be shown in some obscured way or should they be skipped and a dotted line shown between the two interfaces that do have permissions or perhaps the trace functionality should only work if permissions are granted all the way down the chain?
adam added the status: duplicate label 2025-12-29 18:36:36 +01:00
adam closed this issue 2025-12-29 18:36:36 +01:00
adam commented 2025-12-29 18:36:36 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 26, 2021):

Thank you for submitting this issue, however it appears that this topic has already been raised. Please see issue #4944 for further discussion.

@jeremystretch commented on GitHub (Jan 26, 2021): Thank you for submitting this issue, however it appears that this topic has already been raised. Please see issue #4944 for further discussion.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: duplicate
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4492
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?