Restrict the MAC address view's MAC prefixes to those the user can view, and handle negative limits for available MAC addresses

netbox/dcim/api/views.py

@@ -624,7 +624,9 @@ class MACPrefixAvailableMACAddressesView(AvailableObjectsView):
 
     def get_available_objects(self, parent, limit=None):
         # A prefix may contain millions of available MAC addresses, so always apply a limit
-        return list(islice(parent.iter_available_mac_addresses(), limit or get_config().PAGINATE_COUNT))
+        if not limit or limit < 0:
+            limit = get_config().PAGINATE_COUNT
+        return list(islice(parent.iter_available_mac_addresses(), limit))
 
     def prep_object_data(self, requested_objects, available_objects, parent):
         for i, request_data in enumerate(requested_objects):

netbox/dcim/tests/test_api.py

@@ -7480,6 +7480,11 @@ class MACPrefixTestCase(APIViewTestCases.APIViewTestCase):
         response = self.client.get(url, {'limit': 2}, **self.header)
         self.assertEqual(len(response.data), 2)
 
+        # An invalid limit falls back to the default
+        response = self.client.get(url, {'limit': -1}, **self.header)
+        self.assertHttpStatus(response, status.HTTP_200_OK)
+        self.assertEqual(len(response.data), 7)
+
         # A large prefix returns a single page of results
         mac_prefix = MACPrefix.objects.get(name='Prefix 1')
         url = reverse('dcim-api:macprefix-available-mac-addresses', kwargs={'pk': mac_prefix.pk})

netbox/dcim/tests/test_views.py

@@ -6972,6 +6972,24 @@ class MACAddressTestCase(ViewTestCases.PrimaryObjectViewTestCase):
         self.assertIn(b'quick-add-object', response.content)
         self.assertEqual(initial_count + 1, self._get_queryset().count())
 
+    def test_mac_prefixes_panel(self):
+        """
+        The MAC address page lists the MAC prefixes containing it, only if the user can view MAC prefixes.
+        """
+        MACPrefix.objects.create(prefix='BC:24:11:00:00:00', prefix_length=24, name='Prefix 1')
+        mac_address = MACAddress.objects.create(mac_address='BC:24:11:00:00:01')
+        panel_url = 'contains=BC%3A24%3A11%3A00%3A00%3A01'
+
+        self.add_permissions('dcim.view_macaddress')
+        response = self.client.get(mac_address.get_absolute_url())
+        self.assertHttpStatus(response, 200)
+        self.assertNotContains(response, panel_url)
+
+        self.add_permissions('dcim.view_macprefix')
+        response = self.client.get(mac_address.get_absolute_url())
+        self.assertHttpStatus(response, 200)
+        self.assertContains(response, panel_url)
+
 
 class MACPrefixTestCase(ViewTestCases.PrimaryObjectViewTestCase):
     model = MACPrefix

netbox/dcim/ui/panels.py

@@ -476,7 +476,6 @@ class MACAddressPanel(panels.ObjectAttributesPanel):
     description = attrs.TextAttr('description')
     assignment = attrs.RelatedObjectAttr('assigned_object', linkify=True, grouped_by='parent_object')
     is_primary = attrs.BooleanAttr('is_primary', label=_('Primary for interface'))
-    mac_prefix = attrs.RelatedObjectAttr('mac_prefix', linkify=True, label=_('MAC prefix'))
 
 
 class MACPrefixPanel(panels.ObjectAttributesPanel):

netbox/dcim/views.py

@@ -5870,6 +5870,11 @@ class MACAddressView(generic.ObjectView):
         ],
         right_panels=[
             CommentsPanel(),
+            ObjectsTablePanel(
+                model='dcim.MACPrefix',
+                title=_('MAC Prefixes'),
+                filters={'contains': lambda ctx: str(ctx['object'].mac_address)},
+            ),
         ],
     )