From eb9147a5752e7288005a18e195b9ec0c8a2933d6 Mon Sep 17 00:00:00 2001
From: Jeremy Stretch <stretch@packetlife.net>
Date: Fri, 22 May 2020 11:52:19 -0400
Subject: [PATCH] Enforce object-level permissions for DeviceBay population
 views

---
 netbox/dcim/views.py | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/netbox/dcim/views.py b/netbox/dcim/views.py
index d7e0a336a..733571369 100644
--- a/netbox/dcim/views.py
+++ b/netbox/dcim/views.py
@@ -1647,12 +1647,11 @@ class DeviceBayDeleteView(ObjectDeleteView):
     queryset = DeviceBay.objects.all()
 
 
-class DeviceBayPopulateView(PermissionRequiredMixin, View):
-    permission_required = 'dcim.change_devicebay'
+class DeviceBayPopulateView(ObjectEditView):
+    queryset = DeviceBay.objects.all()
 
     def get(self, request, pk):
-
-        device_bay = get_object_or_404(DeviceBay, pk=pk)
+        device_bay = get_object_or_404(self.queryset, pk=pk)
         form = forms.PopulateDeviceBayForm(device_bay)
 
         return render(request, 'dcim/devicebay_populate.html', {
@@ -1662,8 +1661,7 @@ class DeviceBayPopulateView(PermissionRequiredMixin, View):
         })
 
     def post(self, request, pk):
-
-        device_bay = get_object_or_404(DeviceBay, pk=pk)
+        device_bay = get_object_or_404(self.queryset, pk=pk)
         form = forms.PopulateDeviceBayForm(device_bay, request.POST)
 
         if form.is_valid():
@@ -1681,12 +1679,12 @@ class DeviceBayPopulateView(PermissionRequiredMixin, View):
         })
 
 
-class DeviceBayDepopulateView(PermissionRequiredMixin, View):
-    permission_required = 'dcim.change_devicebay'
+class DeviceBayDepopulateView(ObjectEditView):
+    queryset = DeviceBay.objects.all()
 
     def get(self, request, pk):
 
-        device_bay = get_object_or_404(DeviceBay, pk=pk)
+        device_bay = get_object_or_404(self.queryset, pk=pk)
         form = ConfirmationForm()
 
         return render(request, 'dcim/devicebay_depopulate.html', {
@@ -1697,7 +1695,7 @@ class DeviceBayDepopulateView(PermissionRequiredMixin, View):
 
     def post(self, request, pk):
 
-        device_bay = get_object_or_404(DeviceBay, pk=pk)
+        device_bay = get_object_or_404(self.queryset, pk=pk)
         form = ConfirmationForm(request.POST)
 
         if form.is_valid():