NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-14 09:51:22 -06:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

Fixes #9948: Fix TypeError exception when requesting API tokens list as non-authenticated user

Browse Source
This commit is contained in:
jeremystretch 2022-08-08 11:48:43 -04:00
parent 36ac83a319
commit 876251c1cf
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/release-notes/version-3.2.md
View File

@ -21,6 +21,7 @@
* [#9885](https://github.com/netbox-community/netbox/issues/9885) - Fix child prefix counts when editing/deleting aggregates in bulk * [#9885](https://github.com/netbox-community/netbox/issues/9885) - Fix child prefix counts when editing/deleting aggregates in bulk
* [#9891](https://github.com/netbox-community/netbox/issues/9891) - Ensure consistent ordering for tags during object serialization * [#9891](https://github.com/netbox-community/netbox/issues/9891) - Ensure consistent ordering for tags during object serialization
* [#9919](https://github.com/netbox-community/netbox/issues/9919) - Fix potential XSS avenue via linked objects in tables * [#9919](https://github.com/netbox-community/netbox/issues/9919) - Fix potential XSS avenue via linked objects in tables
* [#9948](https://github.com/netbox-community/netbox/issues/9948) - Fix TypeError exception when requesting API tokens list as non-authenticated user
* [#9949](https://github.com/netbox-community/netbox/issues/9949) - Fix KeyError exception resulting from invalid API token provisioning request * [#9949](https://github.com/netbox-community/netbox/issues/9949) - Fix KeyError exception resulting from invalid API token provisioning request
--- ---

2
netbox/users/api/views.py
View File

@ -58,6 +58,8 @@ class TokenViewSet(NetBoxModelViewSet):
# Workaround for schema generation (drf_yasg) # Workaround for schema generation (drf_yasg)
if getattr(self, 'swagger_fake_view', False): if getattr(self, 'swagger_fake_view', False):
return queryset.none() return queryset.none()
if not self.request.user.is_authenticated:
return queryset.none()
if self.request.user.is_superuser: if self.request.user.is_superuser:
return queryset return queryset
return queryset.filter(user=self.request.user) return queryset.filter(user=self.request.user)