Skip to content

Permissions "By object type" filter offers incorrect choices #5922

@lampwins

Description

@lampwins

Environment

  • Python version: 2.10.5
  • NetBox version: 3.8.5

Steps to Reproduce

  1. Begin with no permission objects defined in the admin panel.
  2. Create a new permission object with the name "test 1".
  3. Select the "can view" action.
  4. Select "dcim > device" as the only object type.
  5. Save the permission object.
  6. Create a second, new permission object with the name "test 2".
  7. Select the "can view" action.
  8. Select "dcim > cable" as the only object type.
  9. Save the permission object.
  10. From the permissions list view in the admin panel note the options for the "By object type" filter on the right.
  11. Attempt to filter the list of objects using one of the options in the filter list, other than the "All" option.

This first image shows the two permission objects defined:
Screen Shot 2021-03-03 at 11 52 41 PM

This second image shows the options in the "By object type" filter:
Screen Shot 2021-03-03 at 11 52 47 PM

Expected Behavior

The options in the "By object type" should reflect the set of object types for defined permission objects, "dcim | device" and "dcim | cable" in this case. Filtering by one of these valid options should return permission objects matching that selection.

Observed Behavior

The available filter options do not reflect the object types of available permission objects. Instead, other content types are displayed (this will vary per installation, due to the nature of the ID assignment of the content type framework).

This occurs due to a bug in the queryset used to filter these content types:

def lookups(self, request, model_admin):
object_types = ObjectPermission.objects.values_list('id', flat=True).distinct()
content_types = ContentType.objects.filter(pk__in=object_types).order_by('app_label', 'model')
return [
(ct.pk, ct) for ct in content_types
]

The content_type query is filtering for PKs of ObjectPermission instances, which is incorrect, but because of the overlapping namespace of integer PKs, the filter returns valid but incorrect content type objects. The object_types query should use object_types__pk instead of id in the values_list() argument.

I am happy to submit the fix for this.

Metadata

Metadata

Assignees

Labels

status: acceptedThis issue has been accepted for implementationtype: bugA confirmed report of unexpected behavior in the application

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions