Closes #10718: Optimize object-based permissions enforcement

netbox/netbox/api/viewsets/mixins.py

@@ -108,6 +108,5 @@ def _validate_objects(self, instance):
             conforming_count = self.queryset.filter(pk__in=[obj.pk for obj in instance]).count()
             if conforming_count != len(instance):
                 raise ObjectDoesNotExist
-        else:
-            # Check that the instance is matched by the view's queryset
-            self.queryset.get(pk=instance.pk)
+        elif not self.queryset.filter(pk=instance.pk).exists():
+            raise ObjectDoesNotExist

netbox/netbox/views/generic/object_views.py

@@ -173,7 +173,7 @@ def _create_object(self, model_form):
         obj = model_form.save()
 
         # Enforce object-level permissions
-        if not self.queryset.filter(pk=obj.pk).first():
+        if not self.queryset.filter(pk=obj.pk).exists():
             raise PermissionsViolation()
 
         # Iterate through the related object forms (if any), validating and saving each instance.
@@ -390,7 +390,7 @@ def post(self, request, *args, **kwargs):
                     obj = form.save()
 
                     # Check that the new object conforms with any assigned object-level permissions
-                    if not self.queryset.filter(pk=obj.pk).first():
+                    if not self.queryset.filter(pk=obj.pk).exists():
                         raise PermissionsViolation()
 
                 msg = '{} {}'.format(