mirror/netbox-community-netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2024-05-10 07:54:54 +00:00
Code Activity

Exclude ObjectPermissions API endpoint from EXEMPT_VIEW_PERMISSIONS

Browse Source
This commit is contained in:
Jeremy Stretch
2020-07-21 17:39:56 -04:00
parent a3d1ee474c
commit 3e6b257fa0
4 changed files with 33 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
netbox/utilities/permissions.py
View File

@ -1,6 +1,12 @@
from django.conf import settings
from django.contrib.contenttypes.models import ContentType
# Exclude potentially sensitive models from wild view exemption. These may still be exempted
# by specifying the model individually in the EXEMPT_VIEW_PERMISSIONS configuration parameter.
EXEMPT_EXCLUDE_MODELS = (
('users', 'objectpermission'),
)
def get_permission_for_model(model, action):
"""
@ -63,11 +69,11 @@ def permission_is_exempt(name):
if action == 'view':
if (
# All models are exempt from view permission enforcement
'*' in settings.EXEMPT_VIEW_PERMISSIONS
# All models (excluding those in EXEMPT_EXCLUDE_MODELS) are exempt from view permission enforcement
'*' in settings.EXEMPT_VIEW_PERMISSIONS and (app_label, model_name) not in EXEMPT_EXCLUDE_MODELS
) or (
# This specific model is exempt from view permission enforcement
'{}.{}'.format(app_label, model_name) in settings.EXEMPT_VIEW_PERMISSIONS
f'{app_label}.{model_name}' in settings.EXEMPT_VIEW_PERMISSIONS
):
return True