-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug]: GraphQL does not properly constrain on getter #212
Comments
Thanks for opening this Issue! We really appreciate the feedback & testing from users like you! |
To fix: - @strawberry.field
- def access_list(self, id: int) -> AccessListType:
- return AccessList.objects.get(pk=id)
+ access_list: AccessListType = strawberry_django.field() - @strawberry.field
- def acl_extended_rule(self, id: int) -> ACLExtendedRuleType:
- return ACLExtendedRule.objects.get(pk=id)
+ acl_extended_rule: ACLExtendedRuleType = strawberry_django.field() - @strawberry.field
- def acl_standard_rule(self, id: int) -> ACLStandardRuleType:
- return ACLStandardRule.objects.get(pk=id)
+ acl_standard_rule: ACLStandardRuleType = strawberry_django.field() |
`PATCH a single object without permission. ... ok ======================================================================
|
NetBox access-list plugin version
v1.6.1
NetBox version
v4.1.1
Steps to Reproduce
Make a graphql request to plugin requesting a specific object which you don't have permissions to
Expected Behavior
Denied access
Observed Behavior
Object returned
The text was updated successfully, but these errors were encountered: