starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Permission constraint doesn't work on sync action #9413

New Issue
Closed
opened 2025-12-29 20:49:29 +01:00 by adam · 1 comment
adam commented 2025-12-29 20:49:29 +01:00
Owner
Copy Link

Originally created by @llamafilm on GitHub (Mar 29, 2024).

Originally assigned to: @arthanson on GitHub.

Deployment Type

Self-hosted

NetBox Version

v3.7.3

Python Version

3.11

Steps to Reproduce

  1. Create a user permission with object type: Core > Data Source. Allow add, view, and sync actions. Add constraint: {"id": 4}.
  2. Create an API token for this user
  3. Sync a different data source: curl -X POST -H "Authorization: Token $TOKEN" -H "Accept: application/json" http://localhost:8001/api/core/data-sources/7/sync/

Additional Context

I'd like to sync this git data source it as a post-commit hook when I make changes to the scripts. So I want to restrict this user permission to only one data source.

The constraint works properly on the view action. If I GET /api/core/data-sources/7/ I get a response: {"detail":"Not found."}.

Expected Behavior

I should get a permission denied error.

Observed Behavior

It works.

Originally created by @llamafilm on GitHub (Mar 29, 2024). Originally assigned to: @arthanson on GitHub. ### Deployment Type Self-hosted ### NetBox Version v3.7.3 ### Python Version 3.11 ### Steps to Reproduce 1. Create a user permission with object type: `Core > Data Source`. Allow `add`, `view`, and `sync` actions. Add constraint: `{"id": 4}`. 2. Create an API token for this user 3. Sync a different data source: `curl -X POST -H "Authorization: Token $TOKEN" -H "Accept: application/json" http://localhost:8001/api/core/data-sources/7/sync/ ` ### Additional Context I'd like to sync this git data source it as a post-commit hook when I make changes to the scripts. So I want to restrict this user permission to only one data source. The constraint works properly on the `view` action. If I GET `/api/core/data-sources/7/` I get a response: `{"detail":"Not found."}`. ### Expected Behavior I should get a permission denied error. ### Observed Behavior It works.
adam added the type: bugstatus: acceptedseverity: medium labels 2025-12-29 20:49:29 +01:00
adam closed this issue 2025-12-29 20:49:29 +01:00
adam commented 2025-12-29 20:49:30 +01:00
Author
Owner
Copy Link

@llamafilm commented on GitHub (Mar 29, 2024):

By the way, it seems weird that the add action is required for this.

@llamafilm commented on GitHub (Mar 29, 2024): By the way, it seems weird that the `add` action is required for this.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label severity: medium status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9413
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?