NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-24 17:38:37 -06:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

Enforce object-level permissions for DeviceBay population views

Browse Source
This commit is contained in:
Jeremy Stretch 2020-05-22 11:52:19 -04:00
parent 781334b615
commit eb9147a575
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
netbox/dcim/views.py
View File

@ -1647,12 +1647,11 @@ class DeviceBayDeleteView(ObjectDeleteView):
queryset = DeviceBay.objects.all() queryset = DeviceBay.objects.all()
class DeviceBayPopulateView(PermissionRequiredMixin, View): class DeviceBayPopulateView(ObjectEditView):
permission_required = 'dcim.change_devicebay' queryset = DeviceBay.objects.all()
def get(self, request, pk): def get(self, request, pk):
device_bay = get_object_or_404(self.queryset, pk=pk)
device_bay = get_object_or_404(DeviceBay, pk=pk)
form = forms.PopulateDeviceBayForm(device_bay) form = forms.PopulateDeviceBayForm(device_bay)
return render(request, 'dcim/devicebay_populate.html', { return render(request, 'dcim/devicebay_populate.html', {
@ -1662,8 +1661,7 @@ class DeviceBayPopulateView(PermissionRequiredMixin, View):
}) })
def post(self, request, pk): def post(self, request, pk):
device_bay = get_object_or_404(self.queryset, pk=pk)
device_bay = get_object_or_404(DeviceBay, pk=pk)
form = forms.PopulateDeviceBayForm(device_bay, request.POST) form = forms.PopulateDeviceBayForm(device_bay, request.POST)
if form.is_valid(): if form.is_valid():
@ -1681,12 +1679,12 @@ class DeviceBayPopulateView(PermissionRequiredMixin, View):
}) })
class DeviceBayDepopulateView(PermissionRequiredMixin, View): class DeviceBayDepopulateView(ObjectEditView):
permission_required = 'dcim.change_devicebay' queryset = DeviceBay.objects.all()
def get(self, request, pk): def get(self, request, pk):
device_bay = get_object_or_404(DeviceBay, pk=pk) device_bay = get_object_or_404(self.queryset, pk=pk)
form = ConfirmationForm() form = ConfirmationForm()
return render(request, 'dcim/devicebay_depopulate.html', { return render(request, 'dcim/devicebay_depopulate.html', {
@ -1697,7 +1695,7 @@ class DeviceBayDepopulateView(PermissionRequiredMixin, View):
def post(self, request, pk): def post(self, request, pk):
device_bay = get_object_or_404(DeviceBay, pk=pk) device_bay = get_object_or_404(self.queryset, pk=pk)
form = ConfirmationForm(request.POST) form = ConfirmationForm(request.POST)
if form.is_valid(): if form.is_valid():