starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-13 13:53:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permissions for images #5333

New Issue
Closed
opened 2025-12-29 19:26:49 +01:00 by adam · 5 comments
adam commented 2025-12-29 19:26:49 +01:00
Owner
Copy Link

Originally created by @dkm77 on GitHub (Sep 7, 2021).

NetBox version

V2.11.12

Feature type

New functionality

Proposed functionality

Add permissions to control access to image files / photos uploaded to NetBox.
It should be possible to control access in a similar way to other objects, for example only allow users to view photos of a specific site.

Use case

We are trying to restrict user access to specific sites to only allow a user to view and/or edit objects belonging to that site.
This works very well using the new object based permission system.

However we noticed that permissions cannot be assigned to images.
A user without any permissions (besides login) can still view all images by entering the correct URL (which is easy to find/test).
We couldn’t find a way to restrict access to images, which seems to be a problem from a data security perspective, as any user could view/download all photos stored within NetBox.

Database changes

No response

External dependencies

No response

Originally created by @dkm77 on GitHub (Sep 7, 2021). ### NetBox version V2.11.12 ### Feature type New functionality ### Proposed functionality Add permissions to control access to image files / photos uploaded to NetBox. It should be possible to control access in a similar way to other objects, for example only allow users to view photos of a specific site. ### Use case We are trying to restrict user access to specific sites to only allow a user to view and/or edit objects belonging to that site. This works very well using the new object based permission system. However we noticed that permissions cannot be assigned to images. A user without any permissions (besides login) can still view all images by entering the correct URL (which is easy to find/test). We couldn’t find a way to restrict access to images, which seems to be a problem from a data security perspective, as any user could view/download all photos stored within NetBox. ### Database changes _No response_ ### External dependencies _No response_
adam added the type: feature label 2025-12-29 19:26:49 +01:00
adam closed this issue 2025-12-29 19:26:49 +01:00
adam commented 2025-12-29 19:26:50 +01:00
Author
Owner
Copy Link

@dkm77 commented on GitHub (Sep 8, 2021):

Today I made some minor modifications to implement this functionality in a way that is good enough for our use case and didn't require too much work.
If anyone is interested I can share the code.

Basically I created overrides for the classes "LoginRequiredMiddleware" (for viewing images which are served as static files), "ImageAttachmentEditView" and "ImageAttachmentDeleteView" (for adding, changing and deleting images through the image-attachment form).
I am extracting the image from the request and then checking if the user has the required permissions on the images' parent (by using the "restrict" method / existing logic for object based permissions).

If the user is allowed to view / add / change / delete the images' parent object, he is allowed to perform these actions on the image as well.
Otherwise access will be denied.
I did some testing and this works well enough for our use case, although of course I am not sure if this is the best implementation.

It would be nice if this could still be implemented as a standard feature so we don't have to maintain our own modifications.

@dkm77 commented on GitHub (Sep 8, 2021): Today I made some minor modifications to implement this functionality in a way that is good enough for our use case and didn't require too much work. If anyone is interested I can share the code. Basically I created overrides for the classes "LoginRequiredMiddleware" (for viewing images which are served as static files), "ImageAttachmentEditView" and "ImageAttachmentDeleteView" (for adding, changing and deleting images through the image-attachment form). I am extracting the image from the request and then checking if the user has the required permissions on the images' parent (by using the "restrict" method / existing logic for object based permissions). If the user is allowed to view / add / change / delete the images' parent object, he is allowed to perform these actions on the image as well. Otherwise access will be denied. I did some testing and this works well enough for our use case, although of course I am not sure if this is the best implementation. It would be nice if this could still be implemented as a standard feature so we don't have to maintain our own modifications.
adam commented 2025-12-29 19:26:50 +01:00
Author
Owner
Copy Link

@sdktr commented on GitHub (Sep 8, 2021):

Not having a seperate permission, but inheriting from the parent object would be my preferer approach as well.

I can't judge your implementation, curious what the maintainers have to say about it.

@sdktr commented on GitHub (Sep 8, 2021): Not having a seperate permission, but inheriting from the parent object would be my preferer approach as well. I can't judge your implementation, curious what the maintainers have to say about it.
adam commented 2025-12-29 19:26:50 +01:00
Author
Owner
Copy Link

@dkm77 commented on GitHub (Sep 9, 2021):

In addition to this there is no change logging for images either. I made a simple implementation for that today as well which also logs image changes under the parent object:
image

@dkm77 commented on GitHub (Sep 9, 2021): In addition to this there is no change logging for images either. I made a simple implementation for that today as well which also logs image changes under the parent object: ![image](https://user-images.githubusercontent.com/8020884/132666490-6387b2ff-3d09-495d-a511-ed298741c861.png)
adam commented 2025-12-29 19:26:50 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 5, 2021):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Dec 5, 2021): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 19:26:50 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Dec 13, 2021):

I believe this was addressed in v3.0. Permissions can be assigned for image attachments, and attaching/removing an image from an object generates a change log message.

@jeremystretch commented on GitHub (Dec 13, 2021): I believe this was addressed in v3.0. Permissions can be assigned for image attachments, and attaching/removing an image from an object generates a change log message.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5333
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?