nautobot 2.4.8__py3-none-any.whl → 2.4.10__py3-none-any.whl

nautobot/core/tests/test_csv.py

@@ -7,7 +7,7 @@ from django.urls import reverse
 
 from nautobot.core.constants import CSV_NO_OBJECT, CSV_NULL_TYPE, VARBINARY_IP_FIELD_REPR_OF_CSV_NO_OBJECT
 from nautobot.dcim.api.serializers import DeviceSerializer
-from nautobot.dcim.models.devices import Controller, Device, DeviceType
+from nautobot.dcim.models.devices import Controller, Device, DeviceType, Platform, SoftwareImageFile, SoftwareVersion
 from nautobot.dcim.models.locations import Location
 from nautobot.extras.models.roles import Role
 from nautobot.extras.models.statuses import Status
@@ -317,3 +317,94 @@ class CSVParsingRelatedTestCase(TestCase):
             tenant=self.device2.tenant,
         )
         self.assertEqual(device4.tags.count(), 0)
+
+    @override_settings(ALLOWED_HOSTS=["*"])
+    def test_m2m_field_import(self):
+        """Test CSV import of M2M field."""
+
+        platform = Platform.objects.first()
+        software_version_status = Status.objects.get_for_model(SoftwareVersion).first()
+        software_image_file_status = Status.objects.get_for_model(SoftwareImageFile).first()
+
+        software_version = SoftwareVersion.objects.create(
+            platform=platform, version="Test version 1.0.0", status=software_version_status
+        )
+        software_image_files = (
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_1.bin",
+                status=software_image_file_status,
+            ),
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_2.bin",
+                status=software_image_file_status,
+                default_image=True,
+            ),
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_3.bin",
+                status=software_image_file_status,
+            ),
+        )
+
+        user = UserFactory.create()
+        user.is_superuser = True
+        user.is_active = True
+        user.save()
+        self.client.force_login(user)
+
+        with self.subTest("Import M2M field using list of UUIDs"):
+            import_data = f"""name,device_type,location,role,status,software_image_files
+TestDevice5,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_image_files[0].pk},{software_image_files[1].pk}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(Device.objects.count(), 3)
+
+            # Assert TestDevice5 got created with the right fields
+            device5 = Device.objects.get(
+                name="TestDevice5",
+                location=self.device.location,
+                device_type=self.device.device_type,
+                role=self.device.role,
+                status=self.device.status,
+                tenant=None,
+            )
+            self.assertEqual(device5.software_image_files.count(), 2)
+
+        with self.subTest("Import M2M field using multiple identifying fields"):
+            import_data = f"""name,device_type,location,role,status,software_image_files__software_version,software_image_files__image_file_name
+TestDevice6,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_version.pk},{software_version.pk}","{software_image_files[0].image_file_name},{software_image_files[1].image_file_name}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(Device.objects.count(), 4)
+
+            # Assert TestDevice5 got created with the right fields
+            device6 = Device.objects.get(
+                name="TestDevice6",
+                location=self.device.location,
+                device_type=self.device.device_type,
+                role=self.device.role,
+                status=self.device.status,
+                tenant=None,
+            )
+            self.assertEqual(device6.software_image_files.count(), 2)
+
+        with self.subTest("Import M2M field using incorrect number of values"):
+            import_data = f"""name,device_type,location,role,status,software_image_files__software_version,software_image_files__image_file_name
+TestDevice7,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_version.pk},{software_version.pk}","{software_image_files[0].image_file_name},{software_image_files[1].image_file_name},{software_image_files[2].image_file_name}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+            self.assertEqual(response.status_code, 200)
+            self.assertContains(response, "Incorrect number of values provided for the software_image_files field")
+            self.assertEqual(Device.objects.count(), 4)

nautobot/core/tests/test_jinja_filters.py

@@ -4,6 +4,8 @@ from netutils.utils import jinja2_convenience_function
 
 from nautobot.core.utils import data
 from nautobot.dcim import models as dcim_models
+from nautobot.extras import models as extras_models
+from nautobot.ipam import models as ipam_models
 
 
 class NautobotJinjaFilterTest(TestCase):
@@ -85,3 +87,60 @@ class NautobotJinjaFilterTest(TestCase):
             self.fail("SecurityError raised on safe Jinja template render")
         else:
             self.assertEqual(value, location.parent.name)
+
+    def test_render_blocks_various_unsafe_methods(self):
+        """Assert that Jinja template rendering correctly blocks various unsafe Nautobot APIs."""
+        device = dcim_models.Device.objects.first()
+        dynamic_group = extras_models.DynamicGroup.objects.first()
+        git_repository = extras_models.GitRepository.objects.create(
+            name="repo", slug="repo", remote_url="file:///", branch="main"
+        )
+        interface = dcim_models.Interface.objects.first()
+        interface_template = dcim_models.InterfaceTemplate.objects.first()
+        location = dcim_models.Location.objects.first()
+        module = dcim_models.Module.objects.first()
+        prefix = ipam_models.Prefix.objects.first()
+        secret = extras_models.Secret.objects.create(name="secret", provider="environment-variable")
+        vrf = ipam_models.VRF.objects.first()
+
+        context = {
+            "device": device,
+            "dynamic_group": dynamic_group,
+            "git_repository": git_repository,
+            "interface": interface,
+            "interface_template": interface_template,
+            "location": location,
+            "module": module,
+            "prefix": prefix,
+            "secret": secret,
+            "vrf": vrf,
+            "JobResult": extras_models.JobResult,
+            "ScheduledJob": extras_models.ScheduledJob,
+        }
+
+        for call in [
+            "device.create_components()",
+            "dynamic_group.add_members([])",
+            "dynamic_group.remove_members([])",
+            "git_repository.sync(None)",
+            "git_repository.clone_to_directory()",
+            "git_repository.cleanup_cloned_directory('/tmp/')",
+            "interface.render_name_template()",
+            "interface.add_ip_addresses([])",
+            "interface_template.instantiate(device)",
+            "interface_template.instantiate_model(interface_template, device)",
+            "location.validated_save()",
+            "module.create_components()",
+            "module.render_component_names()",
+            "prefix.reparent_ips()",
+            "prefix.reparent_subnets()",
+            "secret.get_value()",
+            "vrf.add_device(device)",
+            "vrf.add_prefix(prefix)",
+            "JobResult.enqueue_job(None, None)",
+            "JobResult.log('hello world')",
+            "ScheduledJob.create_schedule(None, None)",
+        ]:
+            with self.subTest(call=call):
+                with self.assertRaises(SecurityError):
+                    data.render_jinja2(template_code="{{ " + call + " }}", context=context)

nautobot/core/tests/test_jobs.py

@@ -1,5 +1,7 @@
 import codecs
+import csv
 from datetime import timedelta
+from io import StringIO
 import json
 from pathlib import Path
 
@@ -10,6 +12,7 @@ from django.utils import timezone
 import yaml
 
 from nautobot.circuits.models import Circuit, CircuitType, Provider
+from nautobot.core.jobs import ExportObjectList
 from nautobot.core.jobs.cleanup import CleanupTypes
 from nautobot.core.testing import create_job_result_and_run_job, TransactionTestCase
 from nautobot.core.testing.context import load_event_broker_override_settings
@@ -25,6 +28,7 @@ from nautobot.extras.models import (
     JobResult,
     ObjectChange,
     Role,
+    SavedView,
     Status,
     Tag,
 )
@@ -40,6 +44,32 @@ class ExportObjectListTest(TransactionTestCase):
 
     databases = ("default", "job_logs")
 
+    def _create_saved_view(self, model_class=Status, config=None):
+        """Helper to create a SavedView with optional filter config."""
+        return SavedView.objects.create(
+            name="Global default View",
+            owner=self.user,
+            view=f"{model_class._meta.app_label}:{model_class._meta.model_name}_list",
+            is_global_default=True,
+            config=config or {},
+        )
+
+    def _run_export_job(self, query_string, model_class=Status):
+        """Helper to run export job and return parsed CSV rows."""
+        job_result = create_job_result_and_run_job(
+            "nautobot.core.jobs",
+            "ExportObjectList",
+            content_type=ContentType.objects.get_for_model(model_class).pk,
+            query_string=query_string,
+        )
+        self.assertJobResultStatus(job_result)
+        self.assertTrue(job_result.files.exists())
+        self.assertEqual(
+            Path(job_result.files.first().file.name).name, f"nautobot_{model_class._meta.verbose_name_plural}.csv"
+        )
+        csv_data = job_result.files.first().file.read().decode("utf-8").lstrip("\ufeff")
+        return list(csv.DictReader(StringIO(csv_data)))
+
     def test_export_without_permission(self):
         """Job should enforce user permissions on the content-type being asked for export."""
         job_result = create_job_result_and_run_job(
@@ -136,6 +166,89 @@ class ExportObjectListTest(TransactionTestCase):
         data = yaml.safe_load(yaml_data)
         self.assertEqual(data["manufacturer"], "Cisco")
 
+    def test_get_saved_view_filter_params(self):
+        """Test various cases for the saved view filter parameters."""
+        saved_view = self._create_saved_view(config={"filter_params": {"name": ["Active"]}})
+        test_cases = [
+            # (query_params, expected_output)
+            ({"saved_view": saved_view.pk}, {"name": ["Active"]}),
+            (
+                {
+                    "saved_view": saved_view.pk,
+                    "name": ["Active"],
+                    "content_types": ["dcim.devices"],
+                },  # new filter content_types
+                {"name": ["Active"]},
+            ),
+            (
+                {"saved_view": saved_view.pk, "content_types": ["dcim.devices"]},  # name filter was deleted
+                {},
+            ),
+            ({"saved_view": saved_view.pk, "all_filters_removed": "true"}, {}),
+            (
+                {"name": ["Active"]},  # No saved view provided
+                {},
+            ),
+        ]
+
+        for query_params, expected_output in test_cases:
+            with self.subTest(query_params=query_params, expected_output=expected_output):
+                job = ExportObjectList()
+                filter_params = job._get_saved_view_filter_params(query_params)
+                self.assertEqual(filter_params, expected_output)
+
+    def test_export_saved_view_to_csv_without_filters(self):
+        """Export a SavedView to CSV without any filters applied."""
+        # URL: /?saved_view=<id>
+        sv = self._create_saved_view()
+        rows = self._run_export_job(query_string=f"saved_view={sv.pk}")
+        self.assertEqual(len(rows), Status.objects.count())
+
+    def test_export_saved_view_to_csv_with_filters_from_saved_view(self):
+        """Export a SavedView to CSV using filters defined in the SavedView config."""
+        # URL: /?saved_view=<id>
+        filter_name = Status.objects.first().name
+        sv = self._create_saved_view(config={"filter_params": {"name": [filter_name]}})
+        rows = self._run_export_job(query_string=f"saved_view={sv.pk}")
+        self.assertGreaterEqual(Status.objects.count(), 1)  # Ensure multiple Statuses exist and filter works
+        self.assertEqual(len(rows), 1)
+        self.assertEqual(rows[0]["name"], filter_name)
+
+    def test_export_saved_view_to_csv_with_combined_filters(self):
+        """Export a SavedView to CSV using combined filters from SavedView config and query params."""
+        # URL: /?saved_view=<id>&name=<filter_name>&name=<filter_name2>
+        filter_name = Status.objects.first().name
+        filter_name2 = Status.objects.last().name
+        sv = self._create_saved_view(config={"filter_params": {"name": [filter_name]}})
+        rows = self._run_export_job(query_string=f"saved_view={sv.pk}&name={filter_name}&name={filter_name2}")
+        self.assertEqual(len(rows), 2)
+        self.assertEqual(rows[0]["name"], filter_name)
+        self.assertEqual(rows[1]["name"], filter_name2)
+
+    def test_export_saved_view_manufacturer_to_csv_with_replaced_filters(self):
+        """Export a SavedView manufacturer to CSV after replacing filters."""
+        # URL: /?saved_view=<id>&description=<manufacturer2>
+        manufacturer = Manufacturer.objects.create(name="Test Manufacturer")
+        manufacturer2 = Manufacturer.objects.create(name="Test2 Manufacturer", description="test filter")
+        filter_name = manufacturer.name
+        filter_description = manufacturer2.description
+        sv = self._create_saved_view(model_class=Manufacturer, config={"filter_params": {"name": [filter_name]}})
+        rows = self._run_export_job(
+            query_string=f"saved_view={sv.pk}&description={filter_description}", model_class=Manufacturer
+        )
+        self.assertEqual(len(rows), 1)
+        self.assertEqual(rows[0]["name"], manufacturer2.name)
+        self.assertEqual(rows[0]["description"], filter_description)
+        self.assertTrue(all(row["name"] != filter_name for row in rows))
+
+    def test_export_saved_view_to_csv_after_removing_all_filters(self):
+        """Export a SavedView to CSV after removing all filters."""
+        # URL: /?saved_view=<id>&all_filters_removed=true
+        filter_name = Status.objects.first().name
+        sv = self._create_saved_view(config={"filter_params": {"name": [filter_name]}})
+        rows = self._run_export_job(query_string=f"saved_view={sv.pk}&all_filters_removed=true")
+        self.assertEqual(len(rows), Status.objects.count())
+
 
 class ImportObjectsTestCase(TransactionTestCase):
     databases = ("default", "job_logs")

nautobot/core/tests/test_ui.py

@@ -3,10 +3,13 @@
 from unittest.mock import patch
 
 from django.template import Context
+from django.test import RequestFactory
 
 from nautobot.core.templatetags.helpers import HTML_NONE
 from nautobot.core.testing import TestCase
-from nautobot.core.ui.object_detail import BaseTextPanel, DataTablePanel, Panel
+from nautobot.core.ui.object_detail import BaseTextPanel, DataTablePanel, ObjectsTablePanel, Panel
+from nautobot.dcim.models import DeviceRedundancyGroup
+from nautobot.dcim.tables.devices import DeviceTable
 
 
 class DataTablePanelTest(TestCase):
@@ -148,3 +151,52 @@ class BaseTextPanelTest(TestCase):
         panel = BaseTextPanel(weight=100)
         with self.assertRaises(NotImplementedError):
             panel.get_value({})
+
+
+class ObjectsTablePanelTest(TestCase):
+    def setUp(self):
+        super().setUp()
+        self.factory = RequestFactory()
+        self.request = self.factory.get("/")
+        self.request.user = self.user
+
+    def test_include_exclude_columns(self):
+        panel = ObjectsTablePanel(
+            weight=100,
+            table_class=DeviceTable,
+            table_attribute="devices_sorted",
+            related_field_name="device_redundancy_group",
+            include_columns=[
+                "device_redundancy_group_priority",
+            ],
+            exclude_columns=[
+                "rack",
+            ],
+        )
+        redundancy_group = DeviceRedundancyGroup.objects.first()
+        context = {
+            "request": self.request,
+            "object": redundancy_group,
+        }
+        result = panel.get_extra_context(context)
+        columns = result["body_content_table"].columns
+        self.assertIn("device_redundancy_group_priority", [col.name for col in columns])
+        self.assertNotIn("rack", [col.name for col in columns])
+
+    def test_invalid_include_columns(self):
+        with self.assertRaises(ValueError) as context:
+            panel = ObjectsTablePanel(
+                weight=100,
+                table_class=DeviceTable,
+                table_attribute="devices_sorted",
+                related_field_name="device_redundancy_group",
+                include_columns=["non_existent_column"],
+            )
+            redundancy_group = DeviceRedundancyGroup.objects.first()
+            context_data = {
+                "request": self.request,
+                "object": redundancy_group,
+            }
+            panel.get_extra_context(context_data)
+
+        self.assertIn("non-existent column `non_existent_column`", str(context.exception))

nautobot/core/tests/test_utils.py

@@ -714,6 +714,17 @@ class LookupRelatedFunctionTest(TestCase):
                 form_field.queryset, extras_utils.ChangeLoggedModelsQuery().as_queryset()
             )
 
+            form_field = filtering.get_filterset_parameter_form_field(
+                extras_models.ObjectMetadata, "assigned_object_type"
+            )
+            self.assertIsInstance(form_field, forms.MultipleContentTypeField)
+            self.assertQuerysetEqualAndNotEmpty(
+                form_field.queryset,
+                ContentType.objects.filter(extras_utils.FeatureQuery("metadata").get_query()).order_by(
+                    "app_label", "model"
+                ),
+            )
+
         with self.subTest("Test prefers_id"):
             form_field = filtering.get_filterset_parameter_form_field(dcim_models.Device, "location")
             self.assertEqual("id", form_field.to_field_name)

nautobot/core/tests/test_views.py

@@ -1,5 +1,7 @@
 import json
+import os
 import re
+import tempfile
 from unittest import mock, skipIf
 import urllib.parse
 
@@ -185,6 +187,77 @@ class HomeViewTestCase(TestCase):
         self.assertNotIn("Welcome to Nautobot!", response.content.decode(response.charset))
 
 
+class MediaViewTestCase(TestCase):
+    def test_media_unauthenticated(self):
+        """
+        Test that unauthenticated users are redirected to login when accessing media files whether they exist or not.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(
+                MEDIA_ROOT=temp_dir,
+                BRANDING_FILEPATHS={"logo": os.path.join("branding", "logo.txt")},
+            ):
+                file_path = os.path.join(temp_dir, "foo.txt")
+                url = reverse("media", kwargs={"path": "foo.txt"})
+                self.client.logout()
+
+                # Unauthenticated request to nonexistent media file should redirect to login page
+                response = self.client.get(url)
+                self.assertRedirects(
+                    response, expected_url=f"{reverse('login')}?next={url}", status_code=302, target_status_code=200
+                )
+
+                # Unauthenticated request to existent media file should redirect to login page as well
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+                response = self.client.get(url)
+                self.assertRedirects(
+                    response, expected_url=f"{reverse('login')}?next={url}", status_code=302, target_status_code=200
+                )
+
+    def test_branding_media(self):
+        """
+        Test that users can access branding files listed in `settings.BRANDING_FILEPATHS` regardless of authentication.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(
+                MEDIA_ROOT=temp_dir,
+                BRANDING_FILEPATHS={"logo": os.path.join("branding", "logo.txt")},
+            ):
+                os.makedirs(os.path.join(temp_dir, "branding"))
+                file_path = os.path.join(temp_dir, "branding", "logo.txt")
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+
+                url = reverse("media", kwargs={"path": "branding/logo.txt"})
+
+                # Authenticated request succeeds
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+                # Unauthenticated request also succeeds
+                self.client.logout()
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+    def test_media_authenticated(self):
+        """
+        Test that authenticated users can access regular media files stored in the `MEDIA_ROOT`.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(MEDIA_ROOT=temp_dir):
+                file_path = os.path.join(temp_dir, "foo.txt")
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+
+                url = reverse("media", kwargs={"path": "foo.txt"})
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+
 @override_settings(BRANDING_TITLE="Nautobot")
 class SearchFieldsTestCase(TestCase):
     def test_search_bar_redirect_to_login(self):

nautobot/core/ui/object_detail.py

@@ -728,9 +728,7 @@ class ObjectsTablePanel(Panel):
             table_title (str, optional): The title to display in the panel heading for the table.
                 If None, defaults to the plural verbose name of the table model.
             include_columns (list, optional): A list of field names to include in the table display.
-                If provided, only these fields will be displayed in the table.
             exclude_columns (list, optional): A list of field names to exclude from the table display.
-                Mutually exclusive with `include_columns`.
             add_button_route (str, optional): The route used to generate the "add" button URL. Defaults to "default",
                 which uses the default table's model `add` route.
             add_permissions (list, optional): A list of permissions required for the "add" button to be displayed.
@@ -777,8 +775,6 @@ class ObjectsTablePanel(Panel):
         self.order_by_fields = order_by_fields
         self.table_title = table_title
         self.max_display_count = max_display_count
-        if exclude_columns and include_columns:
-            raise ValueError("You can only specify either `exclude_columns` or `include_columns`")
         self.include_columns = include_columns
         self.exclude_columns = exclude_columns
         self.add_button_route = add_button_route
@@ -878,14 +874,17 @@ class ObjectsTablePanel(Panel):
                 # to redirect the user back to the correct tab after editing/deleteing an object
                 body_content_table.columns["actions"].column.extra_context["return_url_extra"] = f"?tab={self.tab_id}"
 
-        if self.exclude_columns or self.include_columns:
+        if self.exclude_columns:
             for column in body_content_table.columns:
-                if (self.exclude_columns and column.name in self.exclude_columns) or (
-                    self.include_columns and column.name not in self.include_columns
-                ):
+                if column.name in self.exclude_columns:
                     body_content_table.columns.hide(column.name)
-                else:
-                    body_content_table.columns.show(column.name)
+
+        if self.include_columns:
+            for column in self.include_columns:
+                if column not in body_content_table.base_columns:
+                    raise ValueError(f"You are specifying a non-existent column `{column}`")
+                body_content_table.columns.show(column)
+
         # Enable bulk action toggle if the user has appropriate permissions
         user = request.user
         if self.enable_bulk_actions and (
@@ -906,10 +905,18 @@ class ObjectsTablePanel(Panel):
         body_content_table_model = body_content_table.Meta.model
         related_field_name = self.related_field_name or self.table_filter or obj._meta.model_name
 
+        list_url = getattr(self.table_class, "list_url", None)
+        if not list_url:
+            list_url = get_route_for_model(body_content_table_model, "list")
+
         try:
-            list_route = reverse(get_route_for_model(body_content_table_model, "list"))
-            body_content_table_list_url = f"{list_route}?{related_field_name}={obj.pk}"
+            list_route = reverse(list_url)
         except NoReverseMatch:
+            list_route = None
+
+        if list_route:
+            body_content_table_list_url = f"{list_route}?{related_field_name}={obj.pk}"
+        else:
             body_content_table_list_url = None
 
         body_content_table_add_url = self._get_table_add_url(context)

nautobot/core/urls.py

@@ -2,13 +2,13 @@ from django.conf import settings
 from django.http import HttpResponse, HttpResponseNotFound
 from django.urls import include, path
 from django.views.generic import TemplateView
-from django.views.static import serve
 
 from nautobot.core.views import (
     AboutView,
     CustomGraphQLView,
     get_file_with_authorization,
     HomeView,
+    MediaView,
     NautobotMetricsView,
     NautobotMetricsViewAuth,
     RenderJinjaView,
@@ -51,7 +51,7 @@ urlpatterns = [
     # GraphQL
     path("graphql/", CustomGraphQLView.as_view(graphiql=True), name="graphql"),
     # Serving static media in Django (TODO: should be DEBUG mode only - "This view is NOT hardened for production use")
-    path("media/<path:path>", serve, {"document_root": settings.MEDIA_ROOT}),
+    path("media/<path:path>", MediaView.as_view(), name="media"),
     # Admin
     path("admin/", admin_site.urls),
     # Errors

nautobot/core/utils/filtering.py

@@ -135,11 +135,14 @@ def get_filterset_parameter_form_field(model, parameter, filterset=None):
         from nautobot.core.models.fields import slugify_dashes_to_underscores  # Avoid circular import
 
         plural_name = slugify_dashes_to_underscores(model._meta.verbose_name_plural)
+
         # Cable-connectable models use "cable_terminations", not "cables", as the feature name
         if plural_name == "cables":
             plural_name = "cable_terminations"
         elif plural_name == "metadata_types":
             plural_name = "metadata"
+        elif plural_name == "object_metadata":
+            plural_name = "metadata"
         try:
             form_field = MultipleContentTypeField(choices_as_strings=True, feature=plural_name)
         except KeyError:

nautobot/core/views/__init__.py

@@ -3,6 +3,7 @@ import datetime
 import logging
 import os
 import platform
+import posixpath
 import re
 import sys
 import time
@@ -24,6 +25,7 @@ from django.views.csrf import csrf_failure as _csrf_failure
 from django.views.decorators.csrf import requires_csrf_token
 from django.views.defaults import ERROR_500_TEMPLATE_NAME, page_not_found
 from django.views.generic import TemplateView, View
+from django.views.static import serve
 from graphene_django.views import GraphQLView
 from packaging import version
 from prometheus_client import (
@@ -133,6 +135,25 @@ class HomeView(AccessMixin, TemplateView):
         return self.render_to_response(context)
 
 
+class MediaView(AccessMixin, View):
+    """
+    Serves media files while enforcing login restrictions.
+
+    This view wraps Django's `serve()` function to ensure that access to media files (with the exception of
+    branding files defined in `settings.BRANDING_FILEPATHS`) is restricted to authenticated users.
+    """
+
+    def get(self, request, path):
+        if request.user.is_authenticated:
+            return serve(request, path, document_root=settings.MEDIA_ROOT)
+
+        # Unauthenticated users can access BRANDING_FILEPATHS only
+        if posixpath.normpath(path).lstrip("/") in settings.BRANDING_FILEPATHS.values():
+            return serve(request, path, document_root=settings.MEDIA_ROOT)
+
+        return self.handle_no_permission()
+
+
 class WorkerStatusView(UserPassesTestMixin, TemplateView):
     template_name = "utilities/worker_status.html"
 

nautobot/core/views/renderers.py

@@ -301,7 +301,7 @@ class NautobotHTMLRenderer(renderers.BrowsableAPIRenderer):
                 # If the view does not have a object_detail_content attribute, set it to None.
                 context["object_detail_content"] = None
             context.update(common_detail_view_context(request, instance))
-        elif view.action == "list":
+        if view.action == "list":
             # Construct valid actions for list view.
             valid_actions = self.validate_action_buttons(view, request)
             # Query SavedViews for dropdown button

nautobot/dcim/forms.py

@@ -727,6 +727,16 @@ class RackReservationForm(NautobotModelForm, TenancyForm):
             "tags",
         ]
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        rack = getattr(self.instance, "rack", None)
+        if rack:
+            if not self.initial.get("location"):
+                self.initial["location"] = rack.location
+            if not self.initial.get("rack_group"):
+                self.initial["rack_group"] = rack.rack_group
+
 
 class RackReservationBulkEditForm(TagsBulkEditFormMixin, NautobotBulkEditForm):
     pk = forms.ModelMultipleChoiceField(queryset=RackReservation.objects.all(), widget=forms.MultipleHiddenInput())