NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-14 09:51:22 -06:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

Fixes #7814: Fix restriction of user & group objects in GraphQL API queries

Browse Source
This commit is contained in:
jeremystretch 2021-11-12 08:23:58 -05:00
parent 9f8068e8d1
commit daf6c8e327
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/release-notes/version-3.0.md
View File

@ -22,6 +22,7 @@
* [#7802](https://github.com/netbox-community/netbox/issues/7802) - Differentiate ID and VID columns in VLANs table * [#7802](https://github.com/netbox-community/netbox/issues/7802) - Differentiate ID and VID columns in VLANs table
* [#7808](https://github.com/netbox-community/netbox/issues/7808) - Fix reference values for content type under custom field import form * [#7808](https://github.com/netbox-community/netbox/issues/7808) - Fix reference values for content type under custom field import form
* [#7809](https://github.com/netbox-community/netbox/issues/7809) - Add missing export template support for various models * [#7809](https://github.com/netbox-community/netbox/issues/7809) - Add missing export template support for various models
* [#7814](https://github.com/netbox-community/netbox/issues/7814) - Fix restriction of user & group objects in GraphQL API queries
--- ---

4
netbox/users/graphql/types.py
View File

@ -19,7 +19,7 @@ class GroupType(DjangoObjectType):
@classmethod @classmethod
def get_queryset(cls, queryset, info): def get_queryset(cls, queryset, info):
return RestrictedQuerySet(model=Group) return RestrictedQuerySet(model=Group).restrict(info.context.user, 'view')
class UserType(DjangoObjectType): class UserType(DjangoObjectType):
@ -34,4 +34,4 @@ class UserType(DjangoObjectType):
@classmethod @classmethod
def get_queryset(cls, queryset, info): def get_queryset(cls, queryset, info):
return RestrictedQuerySet(model=User) return RestrictedQuerySet(model=User).restrict(info.context.user, 'view')