Merge branch 'develop' into feature

docs/release-notes/version-3.4.md

@@ -1,5 +1,15 @@
 # NetBox v3.4
 
+## v3.4.10 (2023-04-27)
+
+### Bug Fixes
+
+* [#11607](https://github.com/netbox-community/netbox/issues/11607) - Fix custom object field assignments made via REST API for for cables
+* [#12252](https://github.com/netbox-community/netbox/issues/12252) - Fix ordering of search results when sorting by object name
+* [#12355](https://github.com/netbox-community/netbox/issues/12355) - Fix escaping of certain characters in URL when rendering custom links
+
+---
+
 ## v3.4.9 (2023-04-26)
 
 ### Enhancements

netbox/dcim/api/nested_serializers.py

@@ -456,7 +456,7 @@ class NestedInventoryItemRoleSerializer(WritableNestedSerializer):
 # Cables
 #
 
-class NestedCableSerializer(BaseModelSerializer):
+class NestedCableSerializer(WritableNestedSerializer):
     url = serializers.HyperlinkedIdentityField(view_name='dcim-api:cable-detail')
 
     class Meta:

netbox/extras/models/models.py

@@ -285,7 +285,7 @@ class CustomLink(CloningMixin, ExportTemplatesMixin, ChangeLoggedModel):
         text = clean_html(text, allowed_schemes)
 
         # Sanitize link
-        link = urllib.parse.quote_plus(link, safe='/:?&')
+        link = urllib.parse.quote_plus(link, safe='/:?&=%+[]@#')
 
         # Verify link scheme is allowed
         result = urllib.parse.urlparse(link)

netbox/netbox/search/backends.py

@@ -145,9 +145,12 @@ class CachedValueSearchBackend(SearchBackend):
         )
 
         # Omit any results pertaining to an object the user does not have permission to view
-        return [
-            r for r in results if r.object is not None
-        ]
+        ret = []
+        for r in results:
+            if r.object is not None:
+                r.name = str(r.object)
+                ret.append(r)
+        return ret
 
     def cache(self, instances, indexer=None, remove_existing=True):
         content_type = None

netbox/netbox/tables/tables.py

@@ -219,7 +219,8 @@ class SearchTable(tables.Table):
         order_by="object___meta__verbose_name",
     )
     object = tables.Column(
-        linkify=True
+        linkify=True,
+        order_by=('name', )
     )
     field = tables.Column()
     value = tables.Column()