starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permissions "By object type" filter offers incorrect choices #4626

New Issue
Closed
opened 2025-12-29 18:38:24 +01:00 by adam · 0 comments
adam commented 2025-12-29 18:38:24 +01:00
Owner
Copy Link

Originally created by @lampwins on GitHub (Mar 4, 2021).

Originally assigned to: @jeremystretch on GitHub.

Environment

  • Python version: 2.10.5
  • NetBox version: 3.8.5

Steps to Reproduce

  1. Begin with no permission objects defined in the admin panel.
  2. Create a new permission object with the name "test 1".
  3. Select the "can view" action.
  4. Select "dcim > device" as the only object type.
  5. Save the permission object.
  6. Create a second, new permission object with the name "test 2".
  7. Select the "can view" action.
  8. Select "dcim > cable" as the only object type.
  9. Save the permission object.
  10. From the permissions list view in the admin panel note the options for the "By object type" filter on the right.
  11. Attempt to filter the list of objects using one of the options in the filter list, other than the "All" option.

This first image shows the two permission objects defined:
Screen Shot 2021-03-03 at 11 52 41 PM

This second image shows the options in the "By object type" filter:
Screen Shot 2021-03-03 at 11 52 47 PM

Expected Behavior

The options in the "By object type" should reflect the set of object types for defined permission objects, "dcim | device" and "dcim | cable" in this case. Filtering by one of these valid options should return permission objects matching that selection.

Observed Behavior

The available filter options do not reflect the object types of available permission objects. Instead, other content types are displayed (this will vary per installation, due to the nature of the ID assignment of the content type framework).

This occurs due to a bug in the queryset used to filter these content types:

fa8e70fe26/netbox/users/admin.py (L225-L230)

The content_type query is filtering for PKs of ObjectPermission instances, which is incorrect, but because of the overlapping namespace of integer PKs, the filter returns valid but incorrect content type objects. The object_types query should use object_types__pk instead of id in the values_list() argument.

I am happy to submit the fix for this.

Originally created by @lampwins on GitHub (Mar 4, 2021). Originally assigned to: @jeremystretch on GitHub. <!-- NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED. This form is only for reporting reproducible bugs. If you need assistance with NetBox installation, or if you have a general question, please start a discussion instead: https://github.com/netbox-community/netbox/discussions Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report, and that any plugins have been disabled. --> ### Environment * Python version: 2.10.5 * NetBox version: 3.8.5 <!-- Describe in detail the exact steps that someone else can take to reproduce this bug using the current stable release of NetBox. Begin with the creation of any necessary database objects and call out every operation being performed explicitly. If reporting a bug in the REST API, be sure to reconstruct the raw HTTP request(s) being made: Don't rely on a client library such as pynetbox. --> ### Steps to Reproduce 1. Begin with no permission objects defined in the admin panel. 2. Create a new permission object with the name "test 1". 3. Select the "can view" action. 4. Select "dcim > device" as the only object type. 5. Save the permission object. 6. Create a second, new permission object with the name "test 2". 7. Select the "can view" action. 8. Select "dcim > cable" as the only object type. 9. Save the permission object. 10. From the permissions list view in the admin panel note the options for the "By object type" filter on the right. 11. Attempt to filter the list of objects using one of the options in the filter list, other than the "All" option. This first image shows the two permission objects defined: ![Screen Shot 2021-03-03 at 11 52 41 PM](https://user-images.githubusercontent.com/1297132/109913254-9e161100-7c7b-11eb-8cb5-45998135baf7.png) This second image shows the options in the "By object type" filter: ![Screen Shot 2021-03-03 at 11 52 47 PM](https://user-images.githubusercontent.com/1297132/109913279-aa9a6980-7c7b-11eb-8967-7e7c04161d72.png) <!-- What did you expect to happen? --> ### Expected Behavior The options in the "By object type" should reflect the set of object types for defined permission objects, "dcim | device" and "dcim | cable" in this case. Filtering by one of these valid options should return permission objects matching that selection. <!-- What happened instead? --> ### Observed Behavior The available filter options do not reflect the object types of available permission objects. Instead, other content types are displayed (this will vary per installation, due to the nature of the ID assignment of the content type framework). This occurs due to a bug in the queryset used to filter these content types: https://github.com/netbox-community/netbox/blob/fa8e70fe26311bed0619aa74fcbe8379cf39d0ed/netbox/users/admin.py#L225-L230 The `content_type` query is filtering for PKs of `ObjectPermission` instances, which is incorrect, but because of the overlapping namespace of integer PKs, the filter returns valid but incorrect content type objects. The `object_types` query should use `object_types__pk` instead of `id` in the `values_list()` argument. I am happy to submit the fix for this.
adam added the type: bugstatus: accepted labels 2025-12-29 18:38:24 +01:00
adam closed this issue 2025-12-29 18:38:24 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4626
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?