starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permissions bug for creating virtual interfaces through API #4524

New Issue
Closed
opened 2025-12-29 18:36:57 +01:00 by adam · 6 comments
adam commented 2025-12-29 18:36:57 +01:00
Owner
Copy Link

Originally created by @RobertH1993 on GitHub (Feb 2, 2021).

Environment

  • Python version: 3.9.1
  • NetBox version: v2.9.10

Steps to Reproduce

  1. Create user without superuser status.
  2. Add API token to this user.
  3. Try to create a virtual interface through api:
    curl -X POST -H "Authorization: Token " -H "Content-Type: application/json" --data '{virtual_machine: "549", name: "test", enabled: true}' https://ipam./api/virtualization/interfaces/
  4. Get permission denied error:
    {"detail":"You do not have permission to perform this action."}
  5. Verify that all permissions are enabled for the user this token belongs to, they are.
  6. Enable superuser privileges on this user and try again, interface gets created.

Expected Behavior

I expected the interface to be created when my user with valid access token sends an API request to create one.

Observed Behavior

I got a permission denied error.

Originally created by @RobertH1993 on GitHub (Feb 2, 2021). <!-- NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED. This form is only for reporting reproducible bugs. If you need assistance with NetBox installation, or if you have a general question, please start a discussion instead: https://github.com/netbox-community/netbox/discussions Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report, and that any plugins have been disabled. --> ### Environment * Python version: 3.9.1 * NetBox version: v2.9.10 <!-- Describe in detail the exact steps that someone else can take to reproduce this bug using the current stable release of NetBox. Begin with the creation of any necessary database objects and call out every operation being performed explicitly. If reporting a bug in the REST API, be sure to reconstruct the raw HTTP request(s) being made: Don't rely on a client library such as pynetbox. --> ### Steps to Reproduce 1. Create user without superuser status. 2. Add API token to this user. 3. Try to create a virtual interface through api: curl -X POST -H "Authorization: Token <CENSORED> " -H "Content-Type: application/json" --data '{virtual_machine: "549", name: "test", enabled: true}' https://ipam.<CENSORED>/api/virtualization/interfaces/ 4. Get permission denied error: {"detail":"You do not have permission to perform this action."} 5. Verify that all permissions are enabled for the user this token belongs to, they are. 6. Enable superuser privileges on this user and try again, interface gets created. <!-- What did you expect to happen? --> ### Expected Behavior I expected the interface to be created when my user with valid access token sends an API request to create one. <!-- What happened instead? --> ### Observed Behavior I got a permission denied error.
adam closed this issue 2025-12-29 18:36:57 +01:00
adam commented 2025-12-29 18:36:58 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Feb 2, 2021):

It looks like you skipped assigning permissions to the user account. Just adding a REST API token isn't sufficient. Please add the necessary the permission (virtualization > interface in the admin UI) to add VM interfaces to the user and re-test.

@jeremystretch commented on GitHub (Feb 2, 2021): It looks like you skipped assigning permissions to the user account. Just adding a REST API token isn't sufficient. Please add the necessary the permission (`virtualization > interface` in the admin UI) to add VM interfaces to the user and re-test.
adam commented 2025-12-29 18:36:58 +01:00
Author
Owner
Copy Link

@chriswolske commented on GitHub (Apr 19, 2021):

We had the same issue when trying to add virtual interfaces via the web; is this a new permission, or is it possible that the permission was not carried forward properly though an upgrade? (I'm new to netbox, and my team is telling me that they were able to create the virtual interfaces before we upgraded)

@chriswolske commented on GitHub (Apr 19, 2021): We had the same issue when trying to add virtual interfaces via the web; is this a new permission, or is it possible that the permission was not carried forward properly though an upgrade? (I'm new to netbox, and my team is telling me that they were able to create the virtual interfaces before we upgraded)
adam commented 2025-12-29 18:36:58 +01:00
Author
Owner
Copy Link

@The-Only-God commented on GitHub (May 31, 2021):

I confirm that there is impossible to add virtualizaion.interface permission from web.
Workaround: superuser for API account

@The-Only-God commented on GitHub (May 31, 2021): I confirm that there is impossible to add virtualizaion.interface permission from web. Workaround: superuser for API account
adam commented 2025-12-29 18:36:58 +01:00
Author
Owner
Copy Link

@dsobon commented on GitHub (Jun 11, 2021):

The problem exists regardless via API or web UI.
If the user is not "Global Admin",

  1. Web UI shows "Virtualization" > "Interface" as grayed out and click returns "You do not have permission to view this page"
  2. API call returns "You do not have permission to perform this action."
@dsobon commented on GitHub (Jun 11, 2021): The problem exists regardless via API or web UI. If the user is not "Global Admin", 1) Web UI shows "Virtualization" > "Interface" as grayed out and click returns "You do not have permission to view this page" 2) API call returns "You do not have permission to perform this action."
adam commented 2025-12-29 18:36:58 +01:00
Author
Owner
Copy Link

@RobertH1993 commented on GitHub (Jun 11, 2021):

Yeah to add to this, the problem started when I did an upgrade for netbox the permission was not present a version earlier and on update the permission was not granted to the user.

@RobertH1993 commented on GitHub (Jun 11, 2021): Yeah to add to this, the problem started when I did an upgrade for netbox the permission was not present a version earlier and on update the permission was not granted to the user.
adam commented 2025-12-29 18:36:58 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jun 14, 2021):

This bug was reported for a very old release, and has since been closed due to a lack of reply from the original poster. If you would like to report a similar bug, please submit a new bug report including the detailed steps that can be taken on the current release to reproduced the reported behavior. No further work will be done under this bug report.

@jeremystretch commented on GitHub (Jun 14, 2021): This bug was reported for a very old release, and has since been closed due to a lack of reply from the original poster. If you would like to report a similar bug, please submit a new bug report including the detailed steps that can be taken on the current release to reproduced the reported behavior. No further work will be done under this bug report.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4524
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?