API allows to move components between devices #7774

Closed
opened 2025-12-29 20:28:03 +01:00 by adam · 2 comments
Owner

Originally created by @amk1969 on GitHub (Mar 21, 2023).

NetBox version

v3.4.6

Python version

3.8

Steps to Reproduce

Moving of device components between devices is not supported yet it is possible to update the device assignment via API and likely also via a custom script. This brings inconsistency and allows to create avoidable bugs.

Repatching cables is already blocked. I see no issues with saving all needed info, removing the cable and creating a new one.
This approach can be applied also to other components. Inventory items were for some reason allowed via GUI in https://github.com/netbox-community/netbox/issues/10447

Attached is a demonstration script that creates some devices and then steals console from a device, or moves all interfaces to a VC master because device id was included in the update record by mistake.
component-moves.txt

Expected Behavior

Request should be denied and return error/generate exception.

Observed Behavior

Request succeeds and executes action that is not officially supported per https://github.com/netbox-community/netbox/issues/7346

Originally created by @amk1969 on GitHub (Mar 21, 2023). ### NetBox version v3.4.6 ### Python version 3.8 ### Steps to Reproduce Moving of device components between devices is not supported yet it is possible to update the device assignment via API and likely also via a custom script. This brings inconsistency and allows to create avoidable bugs. Repatching cables is already blocked. I see no issues with saving all needed info, removing the cable and creating a new one. This approach can be applied also to other components. Inventory items were for some reason allowed via GUI in https://github.com/netbox-community/netbox/issues/10447 Attached is a demonstration script that creates some devices and then steals console from a device, or moves all interfaces to a VC master because device id was included in the update record by mistake. [component-moves.txt](https://github.com/netbox-community/netbox/files/11026244/component-moves.txt) ### Expected Behavior Request should be denied and return error/generate exception. ### Observed Behavior Request succeeds and executes action that is not officially supported per https://github.com/netbox-community/netbox/issues/7346
adam added the type: bugstatus: duplicate labels 2025-12-29 20:28:03 +01:00
adam closed this issue 2025-12-29 20:28:03 +01:00
Author
Owner

@kkthxbye-code commented on GitHub (Mar 21, 2023):

I believe this is a duplicate of this issue: https://github.com/netbox-community/netbox/issues/11432

If you believe it is a separate issue, please let me know.

@kkthxbye-code commented on GitHub (Mar 21, 2023): I believe this is a duplicate of this issue: https://github.com/netbox-community/netbox/issues/11432 If you believe it is a separate issue, please let me know.
Author
Owner

@amk1969 commented on GitHub (Mar 21, 2023):

It is indeed a duplicate, thanks for linking.
I was trying hard to find it, but apparently failed. And then spent efforts creating the reproduction script.

@amk1969 commented on GitHub (Mar 21, 2023): It is indeed a duplicate, thanks for linking. I was trying hard to find it, but apparently failed. And then spent efforts creating the reproduction script.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#7774