PATCH request on a token changes the key value

[dchiquito]

Deployment Type

Self-hosted

NetBox Version

v4.0.9

Python Version

3.10

Steps to Reproduce

Make an API call like this:

requests.patch(
    "http://localhost:32768/api/users/tokens/42/",
    json={"write_enabled": False, "description": "modified"}, # Note that key is omitted
    headers={"Authorization": "Token 0123456789abcdef0123456789abcdef01234567"},
)

Expected Behavior

Only fields explicitly listed in the PATCH request should be updated.

Observed Behavior

Any PATCH to a token that omits the key field will repopulate the key field with a randomly generated default value.

This is happening because users.api.serializers.tokens.TokenSerializer.to_internal_value is explicitly setting key if it is not set in the request body. I'm not sure why this is necessary, as the Token model is doing essentially the same thing by overriding save.

[caineblood]

The above comment asking you to download a file is malware to steal your account; do not under any circumstances download or run it. The post needs to be removed. If you have attempted to run it please have your system cleaned and your account secured immediately.