Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User without sufficient permission can create an IP address via FHRP group creation #10719

Closed
jeremystretch opened this issue Oct 21, 2022 · 1 comment
Assignees
Labels
status: accepted This issue has been accepted for implementation type: bug A confirmed report of unexpected behavior in the application

Comments

@jeremystretch
Copy link
Member

NetBox version

v3.3.5

Python version

3.8

Steps to Reproduce

  1. Create a user with permission to view and create FHRP groups but not IP addresses.
  2. Authenticate as that user.
  3. Create an FHRP group with any valid values, and also specify an IP address and status.

Expected Behavior

The creation of an IP address should not be permitted, as the user lacks sufficient permissions.

Observed Behavior

The IP address is created.

@jeremystretch jeremystretch added type: bug A confirmed report of unexpected behavior in the application status: accepted This issue has been accepted for implementation labels Oct 21, 2022
@arthanson arthanson self-assigned this Oct 25, 2022
@jeremystretch
Copy link
Member Author

To be clear, @arthanson's approach in #10747 is greatly preferred over my hack. However, as noted in the PR adding a new method to a generic view would technically be a breaking change to the plugins API, so we'll have to defer for now.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jan 25, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
status: accepted This issue has been accepted for implementation type: bug A confirmed report of unexpected behavior in the application
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants