From 581dc4e0703adc996737bb0e2092623ff386c729 Mon Sep 17 00:00:00 2001 From: Jeremy Stretch Date: Fri, 22 May 2020 12:05:34 -0400 Subject: [PATCH] Enforce object-level permissions for CableTraceView --- netbox/dcim/views.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/netbox/dcim/views.py b/netbox/dcim/views.py index f55d9fd96..3c0010859 100644 --- a/netbox/dcim/views.py +++ b/netbox/dcim/views.py @@ -1857,15 +1857,21 @@ class CableView(ObjectView): }) -class CableTraceView(PermissionRequiredMixin, View): +class CableTraceView(ObjectPermissionRequiredMixin, View): """ Trace a cable path beginning from the given termination. """ permission_required = 'dcim.view_cable' - def get(self, request, model, pk): + def dispatch(self, request, *args, **kwargs): + model = kwargs.pop('model') + self.queryset = model.objects.all() - obj = get_object_or_404(model, pk=pk) + return super().dispatch(request, *args, **kwargs) + + def get(self, request, pk): + + obj = get_object_or_404(self.queryset, pk=pk) path, split_ends = obj.trace() total_length = sum( [entry[1]._abs_length for entry in path if entry[1] and entry[1]._abs_length]