User and group queries are not properly restricted via GraphQL API

[jeremystretch]

NetBox version

v3.0.9

Python version

3.8

Steps to Reproduce

1. Log into NetBox as a user without permission to view user or group objects
2. Navigate to the GraphQL API view (/graphql/)
3. Enter the following query:

query {
    user_list
     {
      username
      password
    }
  }

Expected Behavior

The query should return an empty list due to insufficient permissions.

Observed Behavior

The results are not filtered. This is due to a missing call to restrict() on the queryset for these models. (These models are provided by the Django framework, so they're handled a bit differently than native NetBox models.)

[jeremystretch]

This will be fixed in the next release (v3.0.10). To address any potential security issues in the interim, NetBox administrators have the option of disabling the GraphQL API entirely by setting GRAPHQL_ENABLED = False in configuration.py. Alternatively, you can apply the patch from daf6c8e manually.