Fixes #8499: Content types REST API endpoint should not require model permission

netbox/extras/api/views.py

@@ -4,6 +4,7 @@ from django_rq.queues import get_connection
 from rest_framework import status
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.routers import APIRootView
 from rest_framework.viewsets import ReadOnlyModelViewSet, ViewSet
@@ -382,6 +383,7 @@ class ContentTypeViewSet(ReadOnlyModelViewSet):
     """
     Read-only list of ContentTypes. Limit results to ContentTypes pertinent to NetBox objects.
     """
+    permission_classes = (IsAuthenticated,)
     queryset = ContentType.objects.order_by('app_label', 'model')
     serializer_class = serializers.ContentTypeSerializer
     filterset_class = filtersets.ContentTypeFilterSet

netbox/extras/tests/test_api.py

@@ -608,7 +608,6 @@ class CreatedUpdatedFilterTest(APITestCase):
 
 class ContentTypeTest(APITestCase):
 
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=['contenttypes.contenttype'])
     def test_list_objects(self):
         contenttype_count = ContentType.objects.count()
 
@@ -616,7 +615,6 @@ class ContentTypeTest(APITestCase):
         self.assertHttpStatus(response, status.HTTP_200_OK)
         self.assertEqual(response.data['count'], contenttype_count)
 
-    @override_settings(EXEMPT_VIEW_PERMISSIONS=['contenttypes.contenttype'])
     def test_get_object(self):
         contenttype = ContentType.objects.first()