starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Content-Types only fetchable as SuperUser - hinders usage of Object-Changes #6025

New Issue
Closed
opened 2025-12-29 19:35:50 +01:00 by adam · 1 comment
adam commented 2025-12-29 19:35:50 +01:00
Owner
Copy Link

Originally created by @moonrail on GitHub (Jan 31, 2022).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v3.1.6

Python version

3.9

Steps to Reproduce

  1. Create/Have a User
  2. Do not grant the User SuperUser-Permissions via according flag in Admin-Backend
  3. Grant the User permissions on everything (just for this test)
  4. Log in as the User
    5.1 Try to access /extras/changelog/
    5.2 Try to access /api/extras/content-types/

Expected Behavior

5.1 should show changes without errors, as the User has Permissions on Extras > object change
5.2 should return all Content-Types, a User can use (used e.g. by the Frontend to provide Filters on Changelog)

Observed Behavior

5.1 raises an error, that content-types cannot be fetched. Object-Changes are visible, but Content-Type-Filtering is not possible
5.2 raises an HTTP 403

The only workaround is, to grant the User SuperUser-Permissions via Flag in Admin-Backend.
Obviously this workaround should not be used.

Originally created by @moonrail on GitHub (Jan 31, 2022). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v3.1.6 ### Python version 3.9 ### Steps to Reproduce 1. Create/Have a User 2. Do not grant the User SuperUser-Permissions via according flag in Admin-Backend 3. Grant the User permissions on everything (just for this test) 4. Log in as the User 5.1 Try to access `/extras/changelog/` 5.2 Try to access `/api/extras/content-types/` ### Expected Behavior 5.1 should show changes without errors, as the User has Permissions on `Extras > object change` 5.2 should return all Content-Types, a User can use (used e.g. by the Frontend to provide Filters on Changelog) ### Observed Behavior 5.1 raises an error, that content-types cannot be fetched. Object-Changes are visible, but Content-Type-Filtering is not possible 5.2 raises an HTTP 403 The only workaround is, to grant the User SuperUser-Permissions via Flag in Admin-Backend. Obviously this workaround should not be used.
adam added the type: bugstatus: accepted labels 2025-12-29 19:35:50 +01:00
adam closed this issue 2025-12-29 19:35:51 +01:00
adam commented 2025-12-29 19:35:51 +01:00
Author
Owner
Copy Link

@jweiher commented on GitHub (Jan 31, 2022):

Hi,

i investigated this issue a bit and the core of the problem seems to be that it is not possible to specify permissions for this, but the api view [1] seems to end up here:
https://github.com/encode/django-rest-framework/blob/master/rest_framework/generics.py#L99
Where the permissions are checkend and a 403 is raised if none is found.

I dont see any good point for checking the permissions on the content type anyways, so I would suggest to allow access to this when the user is logged in...

-- Jan

[1] dd71942a5e/netbox/extras/api/views.py (L381)

@jweiher commented on GitHub (Jan 31, 2022): Hi, i investigated this issue a bit and the core of the problem seems to be that it is not possible to specify permissions for this, but the api view [1] seems to end up here: https://github.com/encode/django-rest-framework/blob/master/rest_framework/generics.py#L99 Where the permissions are checkend and a 403 is raised if none is found. I dont see any good point for checking the permissions on the content type anyways, so I would suggest to allow access to this when the user is logged in... -- Jan [1] https://github.com/netbox-community/netbox/blob/dd71942a5e368f302e6a88a9c22697f07555e87b/netbox/extras/api/views.py#L381
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6025
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?