Enforce object-level permissions for ObjectConfigContextView

netbox/dcim/views.py

@@ -1127,9 +1127,8 @@ class DeviceConfigView(ObjectView):
         })
 
 
-class DeviceConfigContextView(PermissionRequiredMixin, ObjectConfigContextView):
-    permission_required = 'dcim.view_device'
-    object_class = Device
+class DeviceConfigContextView(ObjectConfigContextView):
+    queryset = Device.objects.all()
     base_template = 'dcim/device.html'
 
 

netbox/extras/views.py

@@ -154,15 +154,14 @@ class ConfigContextBulkDeleteView(BulkDeleteView):
     default_return_url = 'extras:configcontext_list'
 
 
-class ObjectConfigContextView(View):
-    object_class = None
+class ObjectConfigContextView(ObjectView):
     base_template = None
 
     def get(self, request, pk):
 
-        obj = get_object_or_404(self.object_class, pk=pk)
+        obj = get_object_or_404(self.queryset, pk=pk)
         source_contexts = ConfigContext.objects.get_for_object(obj)
-        model_name = self.object_class._meta.model_name
+        model_name = self.queryset.model._meta.model_name
 
         # Determine user's preferred output format
         if request.GET.get('format') in ['json', 'yaml']:

netbox/virtualization/views.py

@@ -1,5 +1,4 @@
 from django.contrib import messages
-from django.contrib.auth.mixins import PermissionRequiredMixin
 from django.db import transaction
 from django.db.models import Count
 from django.shortcuts import get_object_or_404, redirect, render
@@ -246,9 +245,8 @@ class VirtualMachineView(ObjectView):
         })
 
 
-class VirtualMachineConfigContextView(PermissionRequiredMixin, ObjectConfigContextView):
-    permission_required = 'virtualization.view_virtualmachine'
-    object_class = VirtualMachine
+class VirtualMachineConfigContextView(ObjectConfigContextView):
+    queryset = VirtualMachine.objects.all()
     base_template = 'virtualization/virtualmachine.html'