starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Normal user is able to see every user by having the permission to do rack reservations #7273

New Issue
Closed
opened 2025-12-29 20:21:06 +01:00 by adam · 2 comments
adam commented 2025-12-29 20:21:06 +01:00
Owner
Copy Link

Originally created by @julianstolp on GitHub (Nov 23, 2022).

NetBox version

v3.3.8

Python version

3.10

Steps to Reproduce

  1. Create new User with Status Active only
  2. Create two objectpermissions
<html>
OBJECTPERMISSION OBJECT TYPES ACTIONS CONSTRAINTS
p1 rack reservation view, add, change, delete None
p2 rack view None
</html>
  1. Save
  2. Login as new User
  3. Go to Rack Reservation and add a new one
  4. In field User* it is possible to see all registered users and save for any user

Expected Behavior

The User is not able to see all users and do rack reservations in behalf of every user. The docs https://docs.netbox.dev/en/stable/models/dcim/rackreservation/ say

"Note that users with sufficient permission can make rack reservations for other users."

For me, the user would need to have access to the admin area to see all users.

Observed Behavior

The User is able to see all users and do rack reservations in behalf of every other user.
If calling the API https://demo.netbox.dev/api/users/users/ you get

"detail": "You do not have permission to perform this action."

but you are able to see them anyway via the field User* in rack reservation.

Originally created by @julianstolp on GitHub (Nov 23, 2022). ### NetBox version v3.3.8 ### Python version 3.10 ### Steps to Reproduce 1. Create new User with Status Active only 2. Create two objectpermissions <html> <body> <!--StartFragment--> OBJECTPERMISSION | OBJECT TYPES | ACTIONS | CONSTRAINTS | -- | -- | -- | -- | p1 | rack reservation | view, add, change, delete | None p2 | rack | view | None |   <!--EndFragment--> </body> </html> 4. Save 5. Login as new User 6. Go to Rack Reservation and add a new one 7. In field **User*** it is possible to see all registered users and save for any user ### Expected Behavior The User is not able to see all users and do rack reservations in behalf of every user. The docs https://docs.netbox.dev/en/stable/models/dcim/rackreservation/ say >"Note that users with sufficient permission can make rack reservations for other users." For me, the user would need to have access to the admin area to see all users. ### Observed Behavior The User is able to see all users and do rack reservations in behalf of every other user. If calling the API https://demo.netbox.dev/api/users/users/ you get > "detail": "You do not have permission to perform this action." but you are able to see them anyway via the field **User*** in rack reservation.
adam closed this issue 2025-12-29 20:21:06 +01:00
adam commented 2025-12-29 20:21:07 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Nov 28, 2022):

This is intended behavior; users have been able to create rack reservations on behalf of other users since the feature was introduced. If you would like to disable this ability, you can do so by placing a constraint on the permission granting the ability to create/modify rack reservations.

@jeremystretch commented on GitHub (Nov 28, 2022): This is intended behavior; users have been able to create rack reservations on behalf of other users since the feature was introduced. If you would like to disable this ability, you can do so by placing a constraint on the permission granting the ability to create/modify rack reservations.
adam commented 2025-12-29 20:21:08 +01:00
Author
Owner
Copy Link

@julianstolp commented on GitHub (Nov 28, 2022):

@jeremystretch How can i disable this ability? I would like to give a group of users the ability to add rack reservations but i don't want them to have access to all usernames. Tried with {"user__groups__name": "groupname"} which obviously did not work.
The documentation for this is not clear. As i said, reading the docs it sounded like users would need "sufficient" rights to do so. I would have expected to have to explicitly grant access to these users to make rack reservations on behalf of other users.

@julianstolp commented on GitHub (Nov 28, 2022): @jeremystretch How can i disable this ability? I would like to give a group of users the ability to add rack reservations but i don't want them to have access to all usernames. Tried with {"user__groups__name": "groupname"} which obviously did not work. The documentation for this is not clear. As i said, reading the docs it sounded like users would need "sufficient" rights to do so. I would have expected to have to explicitly grant access to these users to make rack reservations on behalf of other users.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#7273
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?