diff --git a/netbox/ipam/api/views.py b/netbox/ipam/api/views.py index 98420826a..fe828e520 100644 --- a/netbox/ipam/api/views.py +++ b/netbox/ipam/api/views.py @@ -155,7 +155,7 @@ class AvailablePrefixesView(ObjectValidationMixin, APIView): queryset = Prefix.objects.all() def get(self, request, pk): - prefix = get_object_or_404(self.queryset.restrict(request.user), pk=pk) + prefix = get_object_or_404(Prefix.objects.restrict(request.user), pk=pk) available_prefixes = prefix.get_available_prefixes() serializer = serializers.AvailablePrefixSerializer(available_prefixes.iter_cidrs(), many=True, context={ @@ -167,7 +167,8 @@ class AvailablePrefixesView(ObjectValidationMixin, APIView): @advisory_lock(ADVISORY_LOCK_KEYS['available-prefixes']) def post(self, request, pk): - prefix = get_object_or_404(self.queryset.restrict(request.user), pk=pk) + self.queryset = self.queryset.restrict(request.user, 'add') + prefix = get_object_or_404(Prefix.objects.restrict(request.user), pk=pk) available_prefixes = prefix.get_available_prefixes() # Validate Requested Prefixes' length @@ -262,6 +263,7 @@ class AvailableIPAddressesView(ObjectValidationMixin, APIView): @advisory_lock(ADVISORY_LOCK_KEYS['available-ips']) def post(self, request, pk): + self.queryset = self.queryset.restrict(request.user, 'add') parent = self.get_parent(request, pk) # Normalize to a list of objects