From fb3d1ef399ea95ae22b3da67fd59df56e982ac0e Mon Sep 17 00:00:00 2001
From: kkthxbye-code <festll234@gmail.com>
Date: Fri, 13 Jan 2023 22:12:12 +0100
Subject: [PATCH] Check for the extras.run_script permission when running
 scripts via. the API

---
 netbox/extras/api/views.py      | 4 ++++
 netbox/extras/tests/test_api.py | 1 +
 2 files changed, 5 insertions(+)

diff --git a/netbox/extras/api/views.py b/netbox/extras/api/views.py
index 56bc8567d..1423824cd 100644
--- a/netbox/extras/api/views.py
+++ b/netbox/extras/api/views.py
@@ -318,6 +318,10 @@ class ScriptViewSet(ViewSet):
         """
         Run a Script identified as "<module>.<script>" and return the pending JobResult as the result
         """
+
+        if not request.user.has_perm('extras.run_script'):
+            raise PermissionDenied("This user does not have permission to run scripts.")
+
         script = self._get_script(pk)()
         input_serializer = serializers.ScriptInputSerializer(data=request.data)
 
diff --git a/netbox/extras/tests/test_api.py b/netbox/extras/tests/test_api.py
index b959587ce..29e725507 100644
--- a/netbox/extras/tests/test_api.py
+++ b/netbox/extras/tests/test_api.py
@@ -590,6 +590,7 @@ class ScriptTest(APITestCase):
 
     @skipIf(not rq_worker_running, "RQ worker not running")
     def test_run_script(self):
+        self.add_permissions('extras.run_script')
 
         script_data = {
             'var1': 'FooBar',