diff --git a/docs/customization/custom-scripts.md b/docs/customization/custom-scripts.md index 3fe44ed8825..e8130d9a289 100644 --- a/docs/customization/custom-scripts.md +++ b/docs/customization/custom-scripts.md @@ -18,7 +18,17 @@ They can also be used as a mechanism for validating the integrity of data within Custom scripts are Python code which exists outside the NetBox code base, so they can be updated and changed without interfering with the core NetBox installation. And because they're completely custom, there is no inherent limitation on what a script can accomplish. !!! danger "Only install trusted scripts" - Custom scripts have unrestricted access to change anything in the databse and are inherently unsafe and should only be installed and run from trusted sources. You should also review and set permissions for who can run scripts if the script can modify any data. + Custom scripts have unrestricted access to change anything in the database and are inherently unsafe and should only be installed and run from trusted sources. You should also review and set permissions for who can run scripts if the script can modify any data. + +!!! tip "Permissions for Custom Scripts" + A user can be granted permissions on all Custom Scripts via the "Managed File" object-level permission. To further restrict a user to only be able to access certain scripts, create an additional permission on the "Script" object type, with appropriate queryset-style constraints matching fields available on Script. For example: + ```json + { + "name__in": [ + "MyScript" + ] + } + ``` ## Writing Custom Scripts diff --git a/netbox/extras/views.py b/netbox/extras/views.py index 461ed423fda..b8ff5699a26 100644 --- a/netbox/extras/views.py +++ b/netbox/extras/views.py @@ -24,9 +24,11 @@ from netbox.object_actions import * from netbox.views import generic from netbox.views.generic.mixins import TableMixin +from users.models import ObjectPermission from utilities.forms import ConfirmationForm, get_field_value from utilities.htmx import htmx_partial, htmx_maybe_redirect_current_page from utilities.paginator import EnhancedPaginator, get_paginate_count +from utilities.permissions import qs_filter_from_constraints from utilities.query import count_related from utilities.querydict import normalize_querydict from utilities.request import copy_safe_request @@ -1441,12 +1443,24 @@ def get_required_permission(self): return 'extras.view_script' def get(self, request): + # Permissions for the Scripts page are given via the "Managed File" object permission. To further restrict + # users to access only specified scripts, create permissions on the "Script" object with appropriate + # queryset-style constraints matching fields available on Script. script_modules = ScriptModule.objects.restrict(request.user).prefetch_related( 'data_source', 'data_file', 'jobs' ) + script_ct = ContentType.objects.get_for_model(Script) + script_permissions = qs_filter_from_constraints( + ObjectPermission.objects.filter( + users=self.request.user, object_types=script_ct + ).values_list("constraints", flat=True) + ) + available_scripts = Script.objects.filter(script_permissions, module__in=script_modules) + context = { 'model': ScriptModule, 'script_modules': script_modules, + 'available_scripts': available_scripts, } # Use partial template for dashboard widgets diff --git a/netbox/templates/extras/inc/script_list_content.html b/netbox/templates/extras/inc/script_list_content.html index 70b77a27b9d..783d6eac1a6 100644 --- a/netbox/templates/extras/inc/script_list_content.html +++ b/netbox/templates/extras/inc/script_list_content.html @@ -38,81 +38,83 @@

{% for script in scripts %} - {% with last_job=script.get_latest_jobs|first %} - - - {% if script.is_executable %} - {{ script.python_class.name }} - {% else %} - {{ script.python_class.name }} - - - - {% endif %} - - {{ script.python_class.description|markdown|placeholder }} - {% if last_job %} + {% if script in available_scripts %} + {% with last_job=script.get_latest_jobs|first %} + - {{ last_job.created|isodatetime }} + {% if script.is_executable %} + {{ script.python_class.name }} + {% else %} + {{ script.python_class.name }} + + + + {% endif %} + {{ script.python_class.description|markdown|placeholder }} + {% if last_job %} + + {{ last_job.created|isodatetime }} + + + {% badge last_job.get_status_display last_job.get_status_color %} + + {% else %} + {% trans "Never" %} + {{ ''|placeholder }} + {% endif %} - {% badge last_job.get_status_display last_job.get_status_color %} + {% if request.user|can_run:script and script.is_executable %} +
+
+ {% if script.python_class.commit_default %} + + {% endif %} + {% csrf_token %} + +
+
+ {% endif %} - {% else %} - {% trans "Never" %} - {{ ''|placeholder }} + + {% if last_job and not embedded %} + {% for test_name, data in last_job.data.tests.items %} + + + {{ test_name }} + + + {{ data.success }} + {{ data.info }} + {{ data.warning }} + {{ data.failure }} + + + {% endfor %} + {% elif last_job and not last_job.data.log and not embedded %} + {# legacy #} + {% for method, stats in last_job.data.items %} + + + {{ method }} + + + {{ stats.success }} + {{ stats.info }} + {{ stats.warning }} + {{ stats.failure }} + + + {% endfor %} {% endif %} - - {% if request.user|can_run:script and script.is_executable %} -
-
- {% if script.python_class.commit_default %} - - {% endif %} - {% csrf_token %} - -
-
- {% endif %} - - - {% if last_job and not embedded %} - {% for test_name, data in last_job.data.tests.items %} - - - {{ test_name }} - - - {{ data.success }} - {{ data.info }} - {{ data.warning }} - {{ data.failure }} - - - {% endfor %} - {% elif last_job and not last_job.data.log and not embedded %} - {# legacy #} - {% for method, stats in last_job.data.items %} - - - {{ method }} - - - {{ stats.success }} - {{ stats.info }} - {{ stats.warning }} - {{ stats.failure }} - - - {% endfor %} - {% endif %} - {% endwith %} + {% endwith %} + {% endif %} {% endfor %}