NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-28 11:26:26 -06:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

Fixes #7814: Fix restriction of user & group objects in GraphQL API queries

Browse Source
This commit is contained in:
jeremystretch 2021-11-12 08:23:58 -05:00
parent 8575e465e4
commit 5511ff37c4
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/release-notes/version-3.0.md
View File

@ -22,6 +22,7 @@
* [#7802](https://github.com/netbox-community/netbox/issues/7802) - Differentiate ID and VID columns in VLANs table
* [#7808](https://github.com/netbox-community/netbox/issues/7808) - Fix reference values for content type under custom field import form
* [#7809](https://github.com/netbox-community/netbox/issues/7809) - Add missing export template support for various models
* [#7814](https://github.com/netbox-community/netbox/issues/7814) - Fix restriction of user & group objects in GraphQL API queries
---

4
netbox/users/graphql/types.py
View File

@ -19,7 +19,7 @@ class GroupType(DjangoObjectType):
@classmethod
def get_queryset(cls, queryset, info):
return RestrictedQuerySet(model=Group)
return RestrictedQuerySet(model=Group).restrict(info.context.user, 'view')
class UserType(DjangoObjectType):
@ -34,4 +34,4 @@ class UserType(DjangoObjectType):
@classmethod
def get_queryset(cls, queryset, info):
return RestrictedQuerySet(model=User)
return RestrictedQuerySet(model=User).restrict(info.context.user, 'view')