From 3d687a6c2d71807cc25ad5d78f29b99d42243107 Mon Sep 17 00:00:00 2001 From: jeremystretch Date: Fri, 21 Oct 2022 12:39:03 -0400 Subject: [PATCH] Closes #10718: Optimize object-based permissions enforcement --- netbox/netbox/api/viewsets/mixins.py | 5 ++--- netbox/netbox/views/generic/object_views.py | 4 ++-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/netbox/netbox/api/viewsets/mixins.py b/netbox/netbox/api/viewsets/mixins.py index 7dc1111f3..b47c88a4e 100644 --- a/netbox/netbox/api/viewsets/mixins.py +++ b/netbox/netbox/api/viewsets/mixins.py @@ -108,6 +108,5 @@ class ObjectValidationMixin: conforming_count = self.queryset.filter(pk__in=[obj.pk for obj in instance]).count() if conforming_count != len(instance): raise ObjectDoesNotExist - else: - # Check that the instance is matched by the view's queryset - self.queryset.get(pk=instance.pk) + elif not self.queryset.filter(pk=instance.pk).exists(): + raise ObjectDoesNotExist diff --git a/netbox/netbox/views/generic/object_views.py b/netbox/netbox/views/generic/object_views.py index a56a832b6..3b0c77251 100644 --- a/netbox/netbox/views/generic/object_views.py +++ b/netbox/netbox/views/generic/object_views.py @@ -173,7 +173,7 @@ class ObjectImportView(GetReturnURLMixin, BaseObjectView): obj = model_form.save() # Enforce object-level permissions - if not self.queryset.filter(pk=obj.pk).first(): + if not self.queryset.filter(pk=obj.pk).exists(): raise PermissionsViolation() # Iterate through the related object forms (if any), validating and saving each instance. @@ -390,7 +390,7 @@ class ObjectEditView(GetReturnURLMixin, BaseObjectView): obj = form.save() # Check that the new object conforms with any assigned object-level permissions - if not self.queryset.filter(pk=obj.pk).first(): + if not self.queryset.filter(pk=obj.pk).exists(): raise PermissionsViolation() msg = '{} {}'.format(