mirror of
https://github.com/netbox-community/netbox.git
synced 2026-03-23 09:51:59 +01:00
d6b9d30086
Add alters_data=True to methods that modify database or filesystem state and are accessible from Jinja2 sandbox template contexts: - UserConfig.set(), clear(): Persist preference changes when commit=True - ManagedFile.sync_data(): Writes files to scripts/reports storage - ScriptModule.sync_classes(), sync_data(): Creates/deletes Script objects - Job.start(), terminate(): Updates job status, creates notifications Methods intentionally not protected: - DataFile.refresh_from_disk(): Only modifies instance attributes in memory - Overridden save()/delete(): Django's AltersData mixin auto-propagates - Properties like Script.python_class: Not callable in template context Ref: #20356 for exploit details demonstrating the vulnerability