Script object variables display and accept objects the user cannot view

Abierto
  • ¿Algo no está bien?
#82 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
52/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
authentication, backend-api-design

Línea de trabajo

Start by tracing the UI and REST run paths that render and validate Script forms, then inspect how ObjectVar and MultiObjectVar resolve submitted IDs. Check where NetBox's restrict_form_fields() helper is applied and how object-level view permissions affect its queryset. Done means inaccessible objects are neither shown as selected values nor accepted on submission, including REST requests.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

app: scripts Bucket: KTLO severity: low status: backlog type: bug
Plugin Version

v0.0.1

NetBox Version

v4.7.4

Python Version

3.12

Steps to Reproduce
  1. As an administrator, upload and activate this Script: 
    from ipam.models import Prefix
from netbox_scripts import ObjectVar, Script


class InspectPrefix(Script):
    prefix = ObjectVar(model=Prefix)

    def run(self, data, commit):
        self.log_info(str(data['prefix']), obj=data['prefix'])
  2. Create a prefix, such as 10.0.0.0/24, and note its ID.
  3. Sign in as a non-superuser with run permission on the Script and no view permission for prefixes, either directly or through a group.
  4. Open /plugins/netbox-scripts/scripts/<script-id>/run/?prefix=<prefix-id>.
  5. Submit the form.
Expected Behavior

ObjectVar and MultiObjectVar display and accept only objects the requesting user can view, including any object-level permission constraints.

The prefix is not displayed as a selected value. Submitting its ID through the UI or REST API returns an invalid-choice error without creating a Job.

Observed Behavior

The Run page displays 10.0.0.0/24 as the selected prefix. Submitting the form creates a Job with that Prefix object in data, despite the user's lack of view permission.

Dropdown searches and the advanced selector respect view permissions, but prefilled and submitted IDs are resolved against an unrestricted queryset. MultiObjectVar and REST submissions are affected too.

The UI and REST run paths do not apply NetBox's restrict_form_fields() helper before rendering or validating the form. The label is exposed before the Script runs, so permission checks inside run() cannot prevent it.

Lenguaje dominante
Python
Estrellas
8
Forks
0
Merge medio
11 h 41 min
PR fusionados (30 d)
38

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de netbox-community/netbox-scripts

Todos los issues de netbox-community/netbox-scripts

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.