Script object variables display and accept objects the user cannot view

Open
  • Is something wrong?
#82 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
authentication, backend-api-design

Research direction

Start by tracing the UI and REST run paths that render and validate Script forms, then inspect how ObjectVar and MultiObjectVar resolve submitted IDs. Check where NetBox's restrict_form_fields() helper is applied and how object-level view permissions affect its queryset. Done means inaccessible objects are neither shown as selected values nor accepted on submission, including REST requests.

Written by the indexing model from the issue text.

Description

app: scripts severity: low status: backlog type: bug
Plugin Version

v0.0.1

NetBox Version

v4.7.4

Python Version

3.12

Steps to Reproduce
  1. As an administrator, upload and activate this Script: 
    from ipam.models import Prefix
from netbox_scripts import ObjectVar, Script


class InspectPrefix(Script):
    prefix = ObjectVar(model=Prefix)

    def run(self, data, commit):
        self.log_info(str(data['prefix']), obj=data['prefix'])
  2. Create a prefix, such as 10.0.0.0/24, and note its ID.
  3. Sign in as a non-superuser with run permission on the Script and no view permission for prefixes, either directly or through a group.
  4. Open /plugins/netbox-scripts/scripts/<script-id>/run/?prefix=<prefix-id>.
  5. Submit the form.
Expected Behavior

ObjectVar and MultiObjectVar display and accept only objects the requesting user can view, including any object-level permission constraints.

The prefix is not displayed as a selected value. Submitting its ID through the UI or REST API returns an invalid-choice error without creating a Job.

Observed Behavior

The Run page displays 10.0.0.0/24 as the selected prefix. Submitting the form creates a Job with that Prefix object in data, despite the user's lack of view permission.

Dropdown searches and the advanced selector respect view permissions, but prefilled and submitted IDs are resolved against an unrestricted queryset. MultiObjectVar and REST submissions are affected too.

The UI and REST run paths do not apply NetBox's restrict_form_fields() helper before rendering or validating the form. The label is exposed before the Script runs, so permission checks inside run() cannot prevent it.

Dominant language
Python
Stars
8
Forks
0
Avg merge
11h 23m
Merged PRs (30d)
24

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from netbox-community/netbox-scripts

All issues in netbox-community/netbox-scripts

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.