nautobot 2.0.4__py3-none-any.whl → 2.1.0b1__py3-none-any.whl

nautobot/core/tests/test_utils.py

@@ -442,58 +442,61 @@ class LookupRelatedFunctionTest(TestCase):
             location_fields = ["comments", "name", "contact_email", "physical_address", "shipping_address"]
             for field_name in location_fields:
                 form_field = filtering.get_filterset_parameter_form_field(dcim_models.Location, field_name)
-                self.assertIsInstance(form_field, django_forms.CharField)
+                self.assertIs(type(form_field), forms.MultiValueCharField)
 
             device_fields = ["serial", "name"]
             for field_name in device_fields:
                 form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, field_name)
-                self.assertIsInstance(form_field, django_forms.CharField)
+                self.assertIs(type(form_field), forms.MultiValueCharField)
 
         with self.subTest("Test IntegerField"):
             form_field = filtering.get_filterset_parameter_form_field(dcim_models.Location, "asn")
-            self.assertIsInstance(form_field, django_forms.IntegerField)
+            self.assertIs(type(form_field), django_forms.IntegerField)
 
             device_fields = ["vc_position", "vc_priority"]
             for field_name in device_fields:
                 form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, field_name)
-                self.assertIsInstance(form_field, django_forms.IntegerField)
+                self.assertIs(type(form_field), django_forms.IntegerField)
 
         with self.subTest("Test DynamicModelMultipleChoiceField"):
             location_fields = ["tenant", "status"]
             for field_name in location_fields:
                 form_field = filtering.get_filterset_parameter_form_field(dcim_models.Location, field_name)
-                self.assertIsInstance(form_field, forms.DynamicModelMultipleChoiceField)
+                self.assertIs(type(form_field), forms.DynamicModelMultipleChoiceField)
 
             device_fields = ["cluster", "device_type", "location"]
             for field_name in device_fields:
                 form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, field_name)
-                self.assertIsInstance(form_field, forms.DynamicModelMultipleChoiceField)
+                self.assertIs(type(form_field), forms.DynamicModelMultipleChoiceField)
 
-        with self.subTest("Test NullBooleanField"):
             location_fields = ["has_circuit_terminations", "has_devices"]
             for field_name in location_fields:
-                form_field = filtering.get_filterset_parameter_form_field(dcim_models.Location, field_name)
-                self.assertIsInstance(form_field, django_forms.NullBooleanField)
+                with self.subTest("Test ChoiceField", model=dcim_models.Location, field_name=field_name):
+                    form_field = filtering.get_filterset_parameter_form_field(dcim_models.Location, field_name)
+                    self.assertIs(type(form_field), django_forms.ChoiceField)
+                    self.assertIs(type(form_field.widget), forms.StaticSelect2)
 
-            device_fields = ["has_console_ports", "has_interfaces"]
+            device_fields = ["has_console_ports", "has_interfaces", "local_config_context_data"]
             for field_name in device_fields:
-                form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, field_name)
-                self.assertIsInstance(form_field, django_forms.NullBooleanField)
+                with self.subTest("Test ChoiceField", model=dcim_models.Device, field_name=field_name):
+                    form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, field_name)
+                    self.assertIs(type(form_field), django_forms.ChoiceField)
+                    self.assertIs(type(form_field.widget), forms.StaticSelect2)
 
-        with self.subTest("Test ChoiceField"):
+        with self.subTest("Test MultipleChoiceField"):
             form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, "face")
-            self.assertIsInstance(form_field, django_forms.ChoiceField)
+            self.assertIs(type(form_field), django_forms.MultipleChoiceField)
 
         with self.subTest("Test DateTimePicker"):
             form_field = filtering.get_filterset_parameter_form_field(dcim_models.Location, "last_updated")
-            self.assertIsInstance(form_field.widget, forms.DateTimePicker)
+            self.assertIs(type(form_field.widget), forms.DateTimePicker)
 
             form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, "last_updated")
-            self.assertIsInstance(form_field.widget, forms.DateTimePicker)
+            self.assertIs(type(form_field.widget), forms.DateTimePicker)
 
         with self.subTest("Test DatePicker"):
             form_field = filtering.get_filterset_parameter_form_field(circuits_models.Circuit, "install_date")
-            self.assertIsInstance(form_field.widget, forms.DatePicker)
+            self.assertIs(type(form_field.widget), forms.DatePicker)
 
         with self.subTest("Test Invalid parameter"):
             with self.assertRaises(exceptions.FilterSetFieldNotFound) as err:
@@ -502,15 +505,15 @@ class LookupRelatedFunctionTest(TestCase):
 
         with self.subTest("Test Content types"):
             form_field = filtering.get_filterset_parameter_form_field(extras_models.Status, "content_types")
-            self.assertIsInstance(form_field, forms.MultipleContentTypeField)
+            self.assertIs(type(form_field), forms.MultipleContentTypeField)
 
             # Assert total ContentTypes generated by form_field is == total `content_types` generated by TaggableClassesQuery
             form_field = filtering.get_filterset_parameter_form_field(extras_models.Tag, "content_types")
-            self.assertIsInstance(form_field, forms.MultipleContentTypeField)
+            self.assertIs(type(form_field), forms.MultipleContentTypeField)
             self.assertEqual(form_field.queryset.count(), extras_utils.TaggableClassesQuery().as_queryset().count())
 
             form_field = filtering.get_filterset_parameter_form_field(extras_models.JobHook, "content_types")
-            self.assertIsInstance(form_field, forms.MultipleContentTypeField)
+            self.assertIs(type(form_field), forms.MultipleContentTypeField)
             self.assertEqual(form_field.queryset.count(), extras_utils.ChangeLoggedModelsQuery().as_queryset().count())
 
     def test_convert_querydict_to_factory_formset_dict(self):

nautobot/core/tests/test_views.py

@@ -37,7 +37,7 @@ class HomeViewTestCase(TestCase):
 
         # Search bar in nav
         nav_search_bar_pattern = re.compile(
-            '<nav.*<form action="/search/" method="get" class="navbar-form navbar-right" id="navbar_search" role="search">.*</form>.*</nav>'
+            '<nav.*<form action="/search/" method="get" class="navbar-form" id="navbar_search" role="search">.*</form>.*</nav>'
         )
         nav_search_bar_result = nav_search_bar_pattern.search(
             response.content.decode(response.charset).replace("\n", "")
@@ -53,8 +53,7 @@ class HomeViewTestCase(TestCase):
 
         return nav_search_bar_result, body_search_bar_result
 
-    @override_settings(HIDE_RESTRICTED_UI=True)
-    def test_search_bar_not_visible_if_user_not_authenticated_and_hide_restricted_ui_True(self):
+    def test_search_bar_not_visible_if_user_not_authenticated(self):
         self.client.logout()
 
         nav_search_bar_result, body_search_bar_result = self.make_request()
@@ -62,23 +61,7 @@ class HomeViewTestCase(TestCase):
         self.assertIsNone(nav_search_bar_result)
         self.assertIsNone(body_search_bar_result)
 
-    @override_settings(HIDE_RESTRICTED_UI=False)
-    def test_search_bar_visible_if_user_authenticated_and_hide_restricted_ui_True(self):
-        nav_search_bar_result, body_search_bar_result = self.make_request()
-
-        self.assertIsNotNone(nav_search_bar_result)
-        self.assertIsNotNone(body_search_bar_result)
-
-    @override_settings(HIDE_RESTRICTED_UI=False)
-    def test_search_bar_visible_if_hide_restricted_ui_False(self):
-        # Assert if user is authenticated
-        nav_search_bar_result, body_search_bar_result = self.make_request()
-
-        self.assertIsNotNone(nav_search_bar_result)
-        self.assertIsNotNone(body_search_bar_result)
-
-        # Assert if user is logout
-        self.client.logout()
+    def test_search_bar_visible_if_user_authenticated(self):
         nav_search_bar_result, body_search_bar_result = self.make_request()
 
         self.assertIsNotNone(nav_search_bar_result)
@@ -229,27 +212,8 @@ class NavRestrictedUI(TestCase):
         response = self.client.get(reverse("home"))
         return response.content.decode(response.charset)
 
-    @override_settings(HIDE_RESTRICTED_UI=True)
-    def test_installed_apps_visible_to_staff_with_hide_restricted_ui_true(self):
-        """The "Installed Apps" menu item should be available to is_staff user regardless of HIDE_RESTRICTED_UI."""
-        # Make user admin
-        self.user.is_staff = True
-        self.user.save()
-
-        response_content = self.make_request()
-        self.assertInHTML(
-            f"""
-            <a href="{self.url}"
-                data-item-weight="{self.item_weight}">
-                Installed Plugins
-            </a>
-            """,
-            response_content,
-        )
-
-    @override_settings(HIDE_RESTRICTED_UI=False)
-    def test_installed_apps_visible_to_staff_with_hide_restricted_ui_false(self):
-        """The "Installed Apps" menu item should be available to is_staff user regardless of HIDE_RESTRICTED_UI."""
+    def test_installed_apps_visible_to_staff(self):
+        """The "Installed Apps" menu item should be available to is_staff user."""
         # Make user admin
         self.user.is_staff = True
         self.user.save()
@@ -265,29 +229,11 @@ class NavRestrictedUI(TestCase):
             response_content,
         )
 
-    @override_settings(HIDE_RESTRICTED_UI=True)
-    def test_installed_apps_not_visible_to_non_staff_user_with_hide_restricted_ui_true(self):
-        """The "Installed Apps" menu item should be hidden from a non-staff user when HIDE_RESTRICTED_UI=True."""
-        response_content = self.make_request()
-
-        self.assertNotRegex(response_content, r"Installed\s+Apps")
-
-    @override_settings(HIDE_RESTRICTED_UI=False)
-    def test_installed_apps_disabled_to_non_staff_user_with_hide_restricted_ui_false(self):
-        """The "Installed Apps" menu item should be disabled for a non-staff user when HIDE_RESTRICTED_UI=False."""
+    def test_installed_apps_not_visible_to_non_staff_user_without_permission(self):
+        """The "Installed Apps" menu item should be hidden from a non-staff user without permission."""
         response_content = self.make_request()
 
-        # print(response_content)
-
-        self.assertInHTML(
-            f"""
-            <a href="{self.url}"
-                data-item-weight="{self.item_weight}">
-                Installed Plugins
-            </a>
-            """,
-            response_content,
-        )
+        self.assertNotRegex(response_content, r"Installed\s+Plugins")
 
 
 class LoginUI(TestCase):
@@ -326,9 +272,9 @@ class LoginUI(TestCase):
         sso_login_search_result = self.make_request()
         self.assertIsNotNone(sso_login_search_result)
 
-    @override_settings(HIDE_RESTRICTED_UI=True, BANNER_TOP="Hello, Banner Top", BANNER_BOTTOM="Hello, Banner Bottom")
-    def test_routes_redirect_back_to_login_if_hide_restricted_ui_true(self):
-        """Assert that api docs and graphql redirects to login page if user is unauthenticated and HIDE_RESTRICTED_UI=True."""
+    @override_settings(BANNER_TOP="Hello, Banner Top", BANNER_BOTTOM="Hello, Banner Bottom")
+    def test_routes_redirect_back_to_login_unauthenticated(self):
+        """Assert that api docs and graphql redirects to login page if user is unauthenticated."""
         self.client.logout()
         headers = {"HTTP_ACCEPT": "text/html"}
         urls = [reverse("api_docs"), reverse("graphql")]
@@ -346,26 +292,6 @@ class LoginUI(TestCase):
                 self.assertNotIn("Hello, Banner Top", response_content)
                 self.assertNotIn("Hello, Banner Bottom", response_content)
 
-    @override_settings(HIDE_RESTRICTED_UI=False, BANNER_TOP="Hello, Banner Top", BANNER_BOTTOM="Hello, Banner Bottom")
-    def test_routes_no_redirect_back_to_login_if_hide_restricted_ui_false(self):
-        """Assert that api docs and graphql do not redirects to login page if user is unauthenticated and HIDE_RESTRICTED_UI=False."""
-        self.client.logout()
-        headers = {"HTTP_ACCEPT": "text/html"}
-        urls = [reverse("api_docs"), reverse("graphql")]
-        for url in urls:
-            response = self.client.get(url, **headers)
-            self.assertHttpStatus(response, 200)
-            self.assertEqual(response.request["PATH_INFO"], url)
-            response_content = response.content.decode(response.charset).replace("\n", "")
-            # Assert Footer items(`self.footer_elements`), Banner and Banner Top is not hidden
-            for footer_text in self.footer_elements:
-                self.assertInHTML(footer_text, response_content)
-
-            # Only API Docs implements BANNERS
-            if url == urls[0]:
-                self.assertInHTML("Hello, Banner Top", response_content)
-                self.assertInHTML("Hello, Banner Bottom", response_content)
-
 
 class MetricsViewTestCase(TestCase):
     def query_and_parse_metrics(self):

nautobot/core/urls.py

@@ -1,6 +1,7 @@
 from django.conf import settings
 from django.conf.urls import include
 from django.urls import path
+from django.views.generic import TemplateView
 from django.views.static import serve
 
 from nautobot.core.views import CustomGraphQLView, HomeView, StaticMediaFailureView, SearchView, nautobot_metrics_view
@@ -31,7 +32,7 @@ urlpatterns = [
     path("api/", include("nautobot.core.api.urls")),
     # GraphQL
     path("graphql/", CustomGraphQLView.as_view(graphiql=True), name="graphql"),
-    # Serving static media in Django
+    # Serving static media in Django (TODO: should be DEBUG mode only - "This view is NOT hardened for production use")
     path("media/<path:path>", serve, {"document_root": settings.MEDIA_ROOT}),
     # Admin
     path("admin/", admin_site.urls),
@@ -46,6 +47,10 @@ urlpatterns = [
     path(r"health/", include("health_check.urls")),
     # FileProxy attachments download/get URLs used in admin views only
     path("files/", include("db_file_storage.urls")),
+    # Templated css file
+    path(
+        "template.css", TemplateView.as_view(template_name="template.css", content_type="text/css"), name="template_css"
+    ),
 ]
 
 

nautobot/core/utils/data.py

@@ -100,7 +100,11 @@ def render_jinja2(template_code, context):
     """
     rendering_engine = engines["jinja"]
     template = rendering_engine.from_string(template_code)
-    return template.render(context=context)
+    # For reasons unknown to me, django-jinja2 `template.render()` implicitly calls `mark_safe()` on the rendered text.
+    # This is a security risk in general, especially so in our case because we're often using this function to render
+    # a user-provided template and don't want to open ourselves up to script injection or similar issues.
+    # There's no `mark_unsafe()` function, but concatenating a SafeString to an ordinary string (even "") suffices.
+    return "" + template.render(context=context)
 
 
 def shallow_compare_dict(source_dict, destination_dict, exclude=None):

nautobot/core/utils/filtering.py

@@ -2,6 +2,7 @@ import re
 
 from django import forms
 from django_filters import (
+    BooleanFilter,
     ChoiceFilter,
     ModelMultipleChoiceFilter,
     MultipleChoiceFilter,
@@ -93,8 +94,10 @@ def get_filterset_parameter_form_field(model, parameter, filterset=None):
     from nautobot.extras.utils import ChangeLoggedModelsQuery, RoleModelsQuery, TaggableClassesQuery
     from nautobot.core.filters import MultiValueDecimalFilter, MultiValueFloatFilter
     from nautobot.core.forms import (
+        BOOLEAN_CHOICES,
         DynamicModelMultipleChoiceField,
         MultipleContentTypeField,
+        StaticSelect2,
         StaticSelect2Multiple,
     )
     from nautobot.virtualization.models import VirtualMachine
@@ -150,11 +153,10 @@ def get_filterset_parameter_form_field(model, parameter, filterset=None):
                 choices_as_strings=True, queryset=queryset_map[plural_name]().as_queryset()
             )
     elif isinstance(field, (MultipleChoiceFilter, ChoiceFilter)) and "choices" in field.extra:
-        form_field_class = forms.ChoiceField
-        form_field_class.widget = StaticSelect2Multiple()
-        form_attr = {"choices": field.extra.get("choices")}
+        form_field = forms.MultipleChoiceField(choices=field.extra.get("choices"), widget=StaticSelect2Multiple)
 
-        form_field = form_field_class(**form_attr)
+    elif isinstance(field, BooleanFilter):
+        form_field = forms.ChoiceField(choices=BOOLEAN_CHOICES, widget=StaticSelect2)
 
     form_field.required = False
     form_field.initial = None

nautobot/core/utils/lookup.py

@@ -192,3 +192,31 @@ def get_table_for_model(model):
         (Union[Table, None]): Either the `Table` class or `None`
     """
     return get_related_class_for_model(model, module_name="tables", object_suffix="Table")
+
+
+def get_created_and_last_updated_usernames_for_model(instance):
+    """
+    Args:
+        instance: A model class instance
+
+    Returns:
+        created_by: Username of the user that created the instance
+        last_updated_by: Username of the user that last modified the instance
+    """
+    from nautobot.extras.choices import ObjectChangeActionChoices
+    from nautobot.extras.models import ObjectChange
+
+    object_change_records = get_changes_for_model(instance)
+    created_by = None
+    last_updated_by = None
+    try:
+        created_by_record = object_change_records.get(action=ObjectChangeActionChoices.ACTION_CREATE)
+        created_by = created_by_record.user_name
+    except ObjectChange.DoesNotExist:
+        pass
+
+    last_updated_by_record = object_change_records.first()
+    if last_updated_by_record:
+        last_updated_by = last_updated_by_record.user_name
+
+    return created_by, last_updated_by

nautobot/core/utils/requests.py

@@ -114,13 +114,12 @@ def get_filterable_params_from_filter_params(filter_params, non_filter_params, f
     Returns:
         (QueryDict): Filter param querydict with only queryset filterable params
     """
-    for non_filter_param in non_filter_params:
-        filter_params.pop(non_filter_param, None)
-
     # Some FilterSet field only accept single choice not multiple choices
     # e.g datetime field, bool fields etc.
     final_filter_params = {}
     for field in filter_params.keys():
+        if field in non_filter_params:
+            continue
         if filter_params.get(field):
             # `is_single_choice_field` implements `get_filterset_field`, which throws an exception if a field is not found.
             # If an exception is thrown, instead of throwing an exception, set `_is_single_choice_field` to 'False'

nautobot/core/views/__init__.py

@@ -25,7 +25,6 @@ from prometheus_client.registry import Collector
 from nautobot.core.constants import SEARCH_MAX_RESULTS
 from nautobot.core.forms import SearchForm
 from nautobot.core.releases import get_latest_release
-from nautobot.core.utils.config import get_settings_or_config
 from nautobot.core.utils.lookup import get_route_for_model
 from nautobot.extras.models import GraphQLQuery
 from nautobot.extras.registry import registry
@@ -58,8 +57,8 @@ class HomeView(AccessMixin, TemplateView):
         return template.render(additional_context)
 
     def get(self, request, *args, **kwargs):
-        # Redirect user to login page if not authenticated and HIDE_RESTRICTED_UI is set to True
-        if not request.user.is_authenticated and get_settings_or_config("HIDE_RESTRICTED_UI"):
+        # Redirect user to login page if not authenticated
+        if not request.user.is_authenticated:
             return self.handle_no_permission()
         # Check whether a new release is available. (Only for staff/superusers.)
         new_release = None
@@ -242,7 +241,7 @@ def csrf_failure(request, reason="", template_name="403_csrf_failure.html"):
 
 class CustomGraphQLView(GraphQLView):
     def render_graphiql(self, request, **data):
-        if not request.user.is_authenticated and get_settings_or_config("HIDE_RESTRICTED_UI"):
+        if not request.user.is_authenticated:
             graphql_url = reverse("graphql")
             login_url = reverse(settings.LOGIN_URL)
             return redirect(f"{login_url}?next={graphql_url}")

nautobot/core/views/generic.py

@@ -16,9 +16,8 @@ from django.db.models import ManyToManyField, ProtectedError
 from django.forms import Form, ModelMultipleChoiceField, MultipleHiddenInput
 from django.http import HttpResponse, JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
-from django.utils.html import escape
+from django.utils.html import format_html
 from django.utils.http import is_safe_url
-from django.utils.safestring import mark_safe
 from django.views.generic import View
 from django_tables2 import RequestConfig
 from rest_framework.exceptions import ParseError
@@ -40,6 +39,7 @@ from nautobot.core.forms import (
 from nautobot.core.forms.forms import DynamicFilterFormSet
 from nautobot.core.templatetags.helpers import bettertitle, validated_viewname
 from nautobot.core.utils.config import get_settings_or_config
+from nautobot.core.utils.lookup import get_created_and_last_updated_usernames_for_model
 from nautobot.core.utils.permissions import get_permission_for_model
 from nautobot.core.utils.requests import (
     convert_querydict_to_factory_formset_acceptable_querydict,
@@ -101,6 +101,8 @@ class ObjectView(ObjectPermissionRequiredMixin, View):
         Generic GET handler for accessing an object.
         """
         instance = get_object_or_404(self.queryset, **kwargs)
+        # Get the ObjectChange records to populate the advanced tab information
+        created_by, last_updated_by = get_created_and_last_updated_usernames_for_model(instance)
 
         # TODO: this feels inelegant - should the tabs lookup be a dedicated endpoint rather than piggybacking
         # on the object-retrieve endpoint?
@@ -128,6 +130,8 @@ class ObjectView(ObjectPermissionRequiredMixin, View):
                     "object": instance,
                     "verbose_name": self.queryset.model._meta.verbose_name,
                     "verbose_name_plural": self.queryset.model._meta.verbose_name_plural,
+                    "created_by": created_by,
+                    "last_updated_by": last_updated_by,
                     **self.get_extra_context(request, instance),
                 },
             )
@@ -153,7 +157,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
     template_name = "generic/object_list.html"
     action_buttons = ("add", "import", "export")
     non_filter_params = (
-        "export",  # trigger for CSV/export-template/YAML export
+        "export",  # trigger for CSV/export-template/YAML export # 3.0 TODO: remove, irrelevant after #4746
         "page",  # used by django-tables2.RequestConfig
         "per_page",  # used by get_paginate_count
         "sort",  # table sorting
@@ -167,7 +171,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
     def get_required_permission(self):
         return get_permission_for_model(self.queryset.model, "view")
 
-    # TODO: remove this as well?
+    # 3.0 TODO: remove, irrelevant after #4746
     def queryset_to_yaml(self):
         """
         Export the queryset of objects as concatenated YAML documents.
@@ -209,7 +213,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
             if not filterset.is_valid():
                 messages.error(
                     request,
-                    mark_safe(f"Invalid filters were specified: {filterset.errors}"),
+                    format_html("Invalid filters were specified: {}", filterset.errors),
                 )
                 self.queryset = self.queryset.none()
 
@@ -230,7 +234,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
                 filter_form = self.filterset_form(filter_params, label_suffix="")
 
         # Check for export template rendering
-        if request.GET.get("export"):
+        if request.GET.get("export"):  # 3.0 TODO: remove, irrelevant after #4746
             et = get_object_or_404(
                 ExportTemplate,
                 content_type=content_type,
@@ -245,7 +249,7 @@ class ObjectListView(ObjectPermissionRequiredMixin, View):
                 )
 
         # Check for YAML export support
-        elif "export" in request.GET and hasattr(model, "to_yaml"):
+        elif "export" in request.GET and hasattr(model, "to_yaml"):  # 3.0 TODO: remove, irrelevant after #4746
             response = HttpResponse(self.queryset_to_yaml(), content_type="text/yaml")
             filename = f"{settings.BRANDING_PREPENDED_FILENAME}{self.queryset.model._meta.verbose_name_plural}.yaml"
             response["Content-Disposition"] = f'attachment; filename="{filename}"'
@@ -397,10 +401,10 @@ class ObjectEditView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
         msg = f"{verb} {self.queryset.model._meta.verbose_name}"
         logger.info(f"{msg} {obj} (PK: {obj.pk})")
         if hasattr(obj, "get_absolute_url"):
-            msg = f'{msg} <a href="{obj.get_absolute_url()}">{escape(obj)}</a>'
+            msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
         else:
-            msg = f"{msg} {escape(obj)}"
-        messages.success(request, mark_safe(msg))
+            msg = format_html("{} {}", msg, obj)
+        messages.success(request, msg)
 
     def post(self, request, *args, **kwargs):
         logger = logging.getLogger(__name__ + ".ObjectEditView")
@@ -752,7 +756,7 @@ class ObjectImportView(GetReturnURLMixin, ObjectPermissionRequiredMixin, View):
                 logger.info(f"Import object {obj} (PK: {obj.pk})")
                 messages.success(
                     request,
-                    mark_safe(f'Imported object: <a href="{obj.get_absolute_url()}">{obj}</a>'),
+                    format_html('Imported object: <a href="{}">{}</a>', obj.get_absolute_url(), obj),
                 )
 
                 if "_addanother" in request.POST:

nautobot/core/views/mixins.py

@@ -19,8 +19,7 @@ from django.template.loader import select_template, TemplateDoesNotExist
 from django.urls import reverse
 from django.urls.exceptions import NoReverseMatch
 from django.utils.http import is_safe_url
-from django.utils.html import escape
-from django.utils.safestring import mark_safe
+from django.utils.html import format_html
 from django.views.generic.edit import FormView
 
 from rest_framework import mixins, exceptions
@@ -605,7 +604,7 @@ class ObjectListViewMixin(NautobotViewSetMixin, mixins.ListModelMixin):
     filterset_class = None
     filterset_form_class = None
     non_filter_params = (
-        "export",  # trigger for CSV/export-template/YAML export
+        "export",  # trigger for CSV/export-template/YAML export # 3.0 TODO: remove, irrelevant after #4746
         "page",  # used by django-tables2.RequestConfig
         "per_page",  # used by get_paginate_count
         "sort",  # table sorting
@@ -622,11 +621,12 @@ class ObjectListViewMixin(NautobotViewSetMixin, mixins.ListModelMixin):
             if not self.filterset.is_valid():
                 messages.error(
                     self.request,
-                    mark_safe(f"Invalid filters were specified: {self.filterset.errors}"),
+                    format_html("Invalid filters were specified: {}", self.filterset.errors),
                 )
                 queryset = queryset.none()
         return queryset
 
+    # 3.0 TODO: remove, irrelevant after #4746
     def check_for_export(self, request, model, content_type):
         # Check for export template rendering
         queryset = self.filter_queryset(self.get_queryset())
@@ -653,6 +653,7 @@ class ObjectListViewMixin(NautobotViewSetMixin, mixins.ListModelMixin):
 
         return None
 
+    # 3.0 TODO: remove, irrelevant after #4746
     def queryset_to_yaml(self):
         """
         Export the queryset of objects as concatenated YAML documents.
@@ -667,7 +668,7 @@ class ObjectListViewMixin(NautobotViewSetMixin, mixins.ListModelMixin):
         List the model instances.
         """
         context = {"use_new_ui": True}
-        if "export" in request.GET:
+        if "export" in request.GET:  # 3.0 TODO: remove, irrelevant after #4746
             queryset = self.get_queryset()
             model = queryset.model
             content_type = ContentType.objects.get_for_model(model)
@@ -748,10 +749,10 @@ class ObjectEditViewMixin(NautobotViewSetMixin, mixins.CreateModelMixin, mixins.
             msg = f'{"Created" if object_created else "Modified"} {queryset.model._meta.verbose_name}'
             self.logger.info(f"{msg} {obj} (PK: {obj.pk})")
             if hasattr(obj, "get_absolute_url"):
-                msg = f'{msg} <a href="{obj.get_absolute_url()}">{escape(obj)}</a>'
+                msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
             else:
-                msg = f"{msg} { escape(obj)}"
-            messages.success(request, mark_safe(msg))
+                msg = format_html("{} {}", msg, obj)
+            messages.success(request, msg)
             if "_addanother" in request.POST:
                 # If the object has clone_fields, pre-populate a new instance of the form
                 if hasattr(obj, "clone_fields"):

nautobot/core/views/renderers.py

@@ -14,6 +14,7 @@ from nautobot.core.forms import (
 from nautobot.core.forms.forms import DynamicFilterFormSet
 from nautobot.core.templatetags.helpers import bettertitle, validated_viewname
 from nautobot.core.utils.config import get_settings_or_config
+from nautobot.core.utils.lookup import get_created_and_last_updated_usernames_for_model
 from nautobot.core.utils.permissions import get_permission_for_model
 from nautobot.core.utils.requests import (
     convert_querydict_to_factory_formset_acceptable_querydict,
@@ -229,6 +230,10 @@ class NautobotHTMLRenderer(renderers.BrowsableAPIRenderer):
             "verbose_name_plural": queryset.model._meta.verbose_name_plural,
         }
         if view.action == "retrieve":
+            created_by, last_updated_by = get_created_and_last_updated_usernames_for_model(instance)
+
+            context["created_by"] = created_by
+            context["last_updated_by"] = last_updated_by
             context.update(view.get_extra_context(request, instance))
         else:
             if view.action == "list":