From b8a8db09edc2f5ddde84b06b799f9ac96cc81545 Mon Sep 17 00:00:00 2001 From: Jeremy Stretch Date: Tue, 14 May 2024 07:53:19 -0400 Subject: [PATCH] Closes #16107: Set `LOGIN_REQUIRED` to True by default (#16122) * Closes #16107: Set LOGIN_REQUIRED to True by default * Update tests --- docs/configuration/security.md | 7 +++++-- netbox/netbox/configuration_example.py | 5 ++--- netbox/netbox/settings.py | 2 +- netbox/netbox/tests/test_plugins.py | 4 +++- netbox/utilities/testing/api.py | 4 ++-- netbox/utilities/testing/views.py | 4 ++-- 6 files changed, 15 insertions(+), 11 deletions(-) diff --git a/docs/configuration/security.md b/docs/configuration/security.md index 45d5bed3f..15702f649 100644 --- a/docs/configuration/security.md +++ b/docs/configuration/security.md @@ -159,9 +159,12 @@ Note that enabling this setting causes NetBox to update a user's session in the ## LOGIN_REQUIRED -Default: False +Default: True -Setting this to True will permit only authenticated users to access any part of NetBox. By default, anonymous users are permitted to access most data in NetBox but not make any changes. +When enabled, only authenticated users are permitted to access any part of NetBox. Disabling this will allow unauthenticated users to access most areas of NetBox (but not make any changes). + +!!! info "Changed in NetBox v4.0.2" + Prior to NetBox v4.0.2, this setting was disabled by default. --- diff --git a/netbox/netbox/configuration_example.py b/netbox/netbox/configuration_example.py index b22fd7b2f..84ead5339 100644 --- a/netbox/netbox/configuration_example.py +++ b/netbox/netbox/configuration_example.py @@ -157,9 +157,8 @@ LOGGING = {} # authenticated to NetBox indefinitely. LOGIN_PERSISTENCE = False -# Setting this to True will permit only authenticated users to access any part of NetBox. By default, anonymous users -# are permitted to access most data in NetBox but not make any changes. -LOGIN_REQUIRED = False +# Setting this to False will permit unauthenticated users to access most areas of NetBox (but not make any changes). +LOGIN_REQUIRED = True # The length of time (in seconds) for which a user will remain logged into the web UI before being prompted to # re-authenticate. (Default: 1209600 [14 days]) diff --git a/netbox/netbox/settings.py b/netbox/netbox/settings.py index b991c5029..f86760b53 100644 --- a/netbox/netbox/settings.py +++ b/netbox/netbox/settings.py @@ -105,7 +105,7 @@ LANGUAGE_CODE = getattr(configuration, 'DEFAULT_LANGUAGE', 'en-us') LANGUAGE_COOKIE_PATH = CSRF_COOKIE_PATH LOGGING = getattr(configuration, 'LOGGING', {}) LOGIN_PERSISTENCE = getattr(configuration, 'LOGIN_PERSISTENCE', False) -LOGIN_REQUIRED = getattr(configuration, 'LOGIN_REQUIRED', False) +LOGIN_REQUIRED = getattr(configuration, 'LOGIN_REQUIRED', True) LOGIN_TIMEOUT = getattr(configuration, 'LOGIN_TIMEOUT', None) LOGOUT_REDIRECT_URL = getattr(configuration, 'LOGOUT_REDIRECT_URL', 'home') MEDIA_ROOT = getattr(configuration, 'MEDIA_ROOT', os.path.join(BASE_DIR, 'media')).rstrip('/') diff --git a/netbox/netbox/tests/test_plugins.py b/netbox/netbox/tests/test_plugins.py index 24bc53005..9ce20e204 100644 --- a/netbox/netbox/tests/test_plugins.py +++ b/netbox/netbox/tests/test_plugins.py @@ -42,6 +42,7 @@ class PluginTest(TestCase): url = reverse('admin:dummy_plugin_dummymodel_add') self.assertEqual(url, '/admin/dummy_plugin/dummymodel/add/') + @override_settings(LOGIN_REQUIRED=False) def test_views(self): # Test URL resolution @@ -53,7 +54,7 @@ class PluginTest(TestCase): response = client.get(url) self.assertEqual(response.status_code, 200) - @override_settings(EXEMPT_VIEW_PERMISSIONS=['*']) + @override_settings(EXEMPT_VIEW_PERMISSIONS=['*'], LOGIN_REQUIRED=False) def test_api_views(self): # Test URL resolution @@ -65,6 +66,7 @@ class PluginTest(TestCase): response = client.get(url) self.assertEqual(response.status_code, 200) + @override_settings(LOGIN_REQUIRED=False) def test_registered_views(self): # Test URL resolution diff --git a/netbox/utilities/testing/api.py b/netbox/utilities/testing/api.py index 563bd84b5..019d6e6ca 100644 --- a/netbox/utilities/testing/api.py +++ b/netbox/utilities/testing/api.py @@ -73,7 +73,7 @@ class APIViewTestCases: class GetObjectViewTestCase(APITestCase): - @override_settings(EXEMPT_VIEW_PERMISSIONS=['*']) + @override_settings(EXEMPT_VIEW_PERMISSIONS=['*'], LOGIN_REQUIRED=False) def test_get_object_anonymous(self): """ GET a single object as an unauthenticated user. @@ -135,7 +135,7 @@ class APIViewTestCases: class ListObjectsViewTestCase(APITestCase): brief_fields = [] - @override_settings(EXEMPT_VIEW_PERMISSIONS=['*']) + @override_settings(EXEMPT_VIEW_PERMISSIONS=['*'], LOGIN_REQUIRED=False) def test_list_objects_anonymous(self): """ GET a list of objects as an unauthenticated user. diff --git a/netbox/utilities/testing/views.py b/netbox/utilities/testing/views.py index e3b12b4c3..6d4ca00df 100644 --- a/netbox/utilities/testing/views.py +++ b/netbox/utilities/testing/views.py @@ -62,7 +62,7 @@ class ViewTestCases: """ Retrieve a single instance. """ - @override_settings(EXEMPT_VIEW_PERMISSIONS=['*']) + @override_settings(EXEMPT_VIEW_PERMISSIONS=['*'], LOGIN_REQUIRED=False) def test_get_object_anonymous(self): # Make the request as an unauthenticated user self.client.logout() @@ -421,7 +421,7 @@ class ViewTestCases: """ Retrieve multiple instances. """ - @override_settings(EXEMPT_VIEW_PERMISSIONS=['*']) + @override_settings(EXEMPT_VIEW_PERMISSIONS=['*'], LOGIN_REQUIRED=False) def test_list_objects_anonymous(self): # Make the request as an unauthenticated user self.client.logout()