nautobot 2.4.9__py3-none-any.whl → 2.4.11__py3-none-any.whl

nautobot/core/tests/test_csv.py

@@ -7,7 +7,7 @@ from django.urls import reverse
 
 from nautobot.core.constants import CSV_NO_OBJECT, CSV_NULL_TYPE, VARBINARY_IP_FIELD_REPR_OF_CSV_NO_OBJECT
 from nautobot.dcim.api.serializers import DeviceSerializer
-from nautobot.dcim.models.devices import Controller, Device, DeviceType
+from nautobot.dcim.models.devices import Controller, Device, DeviceType, Platform, SoftwareImageFile, SoftwareVersion
 from nautobot.dcim.models.locations import Location
 from nautobot.extras.models.roles import Role
 from nautobot.extras.models.statuses import Status
@@ -317,3 +317,94 @@ class CSVParsingRelatedTestCase(TestCase):
             tenant=self.device2.tenant,
         )
         self.assertEqual(device4.tags.count(), 0)
+
+    @override_settings(ALLOWED_HOSTS=["*"])
+    def test_m2m_field_import(self):
+        """Test CSV import of M2M field."""
+
+        platform = Platform.objects.first()
+        software_version_status = Status.objects.get_for_model(SoftwareVersion).first()
+        software_image_file_status = Status.objects.get_for_model(SoftwareImageFile).first()
+
+        software_version = SoftwareVersion.objects.create(
+            platform=platform, version="Test version 1.0.0", status=software_version_status
+        )
+        software_image_files = (
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_1.bin",
+                status=software_image_file_status,
+            ),
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_2.bin",
+                status=software_image_file_status,
+                default_image=True,
+            ),
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_3.bin",
+                status=software_image_file_status,
+            ),
+        )
+
+        user = UserFactory.create()
+        user.is_superuser = True
+        user.is_active = True
+        user.save()
+        self.client.force_login(user)
+
+        with self.subTest("Import M2M field using list of UUIDs"):
+            import_data = f"""name,device_type,location,role,status,software_image_files
+TestDevice5,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_image_files[0].pk},{software_image_files[1].pk}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(Device.objects.count(), 3)
+
+            # Assert TestDevice5 got created with the right fields
+            device5 = Device.objects.get(
+                name="TestDevice5",
+                location=self.device.location,
+                device_type=self.device.device_type,
+                role=self.device.role,
+                status=self.device.status,
+                tenant=None,
+            )
+            self.assertEqual(device5.software_image_files.count(), 2)
+
+        with self.subTest("Import M2M field using multiple identifying fields"):
+            import_data = f"""name,device_type,location,role,status,software_image_files__software_version,software_image_files__image_file_name
+TestDevice6,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_version.pk},{software_version.pk}","{software_image_files[0].image_file_name},{software_image_files[1].image_file_name}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(Device.objects.count(), 4)
+
+            # Assert TestDevice5 got created with the right fields
+            device6 = Device.objects.get(
+                name="TestDevice6",
+                location=self.device.location,
+                device_type=self.device.device_type,
+                role=self.device.role,
+                status=self.device.status,
+                tenant=None,
+            )
+            self.assertEqual(device6.software_image_files.count(), 2)
+
+        with self.subTest("Import M2M field using incorrect number of values"):
+            import_data = f"""name,device_type,location,role,status,software_image_files__software_version,software_image_files__image_file_name
+TestDevice7,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_version.pk},{software_version.pk}","{software_image_files[0].image_file_name},{software_image_files[1].image_file_name},{software_image_files[2].image_file_name}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+            self.assertEqual(response.status_code, 200)
+            self.assertContains(response, "Incorrect number of values provided for the software_image_files field")
+            self.assertEqual(Device.objects.count(), 4)

nautobot/core/tests/test_jinja_filters.py

@@ -4,6 +4,8 @@ from netutils.utils import jinja2_convenience_function
 
 from nautobot.core.utils import data
 from nautobot.dcim import models as dcim_models
+from nautobot.extras import models as extras_models
+from nautobot.ipam import models as ipam_models
 
 
 class NautobotJinjaFilterTest(TestCase):
@@ -85,3 +87,60 @@ class NautobotJinjaFilterTest(TestCase):
             self.fail("SecurityError raised on safe Jinja template render")
         else:
             self.assertEqual(value, location.parent.name)
+
+    def test_render_blocks_various_unsafe_methods(self):
+        """Assert that Jinja template rendering correctly blocks various unsafe Nautobot APIs."""
+        device = dcim_models.Device.objects.first()
+        dynamic_group = extras_models.DynamicGroup.objects.first()
+        git_repository = extras_models.GitRepository.objects.create(
+            name="repo", slug="repo", remote_url="file:///", branch="main"
+        )
+        interface = dcim_models.Interface.objects.first()
+        interface_template = dcim_models.InterfaceTemplate.objects.first()
+        location = dcim_models.Location.objects.first()
+        module = dcim_models.Module.objects.first()
+        prefix = ipam_models.Prefix.objects.first()
+        secret = extras_models.Secret.objects.create(name="secret", provider="environment-variable")
+        vrf = ipam_models.VRF.objects.first()
+
+        context = {
+            "device": device,
+            "dynamic_group": dynamic_group,
+            "git_repository": git_repository,
+            "interface": interface,
+            "interface_template": interface_template,
+            "location": location,
+            "module": module,
+            "prefix": prefix,
+            "secret": secret,
+            "vrf": vrf,
+            "JobResult": extras_models.JobResult,
+            "ScheduledJob": extras_models.ScheduledJob,
+        }
+
+        for call in [
+            "device.create_components()",
+            "dynamic_group.add_members([])",
+            "dynamic_group.remove_members([])",
+            "git_repository.sync(None)",
+            "git_repository.clone_to_directory()",
+            "git_repository.cleanup_cloned_directory('/tmp/')",
+            "interface.render_name_template()",
+            "interface.add_ip_addresses([])",
+            "interface_template.instantiate(device)",
+            "interface_template.instantiate_model(interface_template, device)",
+            "location.validated_save()",
+            "module.create_components()",
+            "module.render_component_names()",
+            "prefix.reparent_ips()",
+            "prefix.reparent_subnets()",
+            "secret.get_value()",
+            "vrf.add_device(device)",
+            "vrf.add_prefix(prefix)",
+            "JobResult.enqueue_job(None, None)",
+            "JobResult.log('hello world')",
+            "ScheduledJob.create_schedule(None, None)",
+        ]:
+            with self.subTest(call=call):
+                with self.assertRaises(SecurityError):
+                    data.render_jinja2(template_code="{{ " + call + " }}", context=context)

nautobot/core/tests/test_jobs.py

@@ -689,10 +689,10 @@ class LogsCleanupTestCase(TransactionTestCase):
                 cleanup_types=[CleanupTypes.JOB_RESULT],
                 max_age=60,
             )
-        self.assertFalse(JobResult.objects.filter(date_done__lt=cutoff).exists())
-        self.assertTrue(JobResult.objects.filter(date_done__gte=cutoff).exists())
-        self.assertTrue(ObjectChange.objects.filter(time__lt=cutoff).exists())
-        self.assertTrue(ObjectChange.objects.filter(time__gte=cutoff).exists())
+        self.assertFalse(JobResult.objects.filter(date_done__lt=cutoff).exists(), cm.output)
+        self.assertTrue(JobResult.objects.filter(date_done__gte=cutoff).exists(), cm.output)
+        self.assertTrue(ObjectChange.objects.filter(time__lt=cutoff).exists(), cm.output)
+        self.assertTrue(ObjectChange.objects.filter(time__gte=cutoff).exists(), cm.output)
 
         started_logs = {
             "job_result_id": str(job_result.id),
@@ -840,6 +840,22 @@ class BulkEditTestCase(TransactionTestCase):
         )
         self._common_no_error_test_assertion(Role, job_result, Role.objects.all().count(), color="aa1409")
 
+    def test_bulk_edit_objects_nullify(self):
+        """
+        Bulk edit Role instances to nullify their weight.
+        """
+        self.add_permissions("extras.change_role", "extras.view_role")
+        job_result = create_job_result_and_run_job(
+            "nautobot.core.jobs.bulk_actions",
+            "BulkEditObjects",
+            content_type=self.role_ct.id,
+            edit_all=True,
+            filter_query_params={},
+            form_data={"_nullify": ["weight"]},
+            username=self.user.username,
+        )
+        self._common_no_error_test_assertion(Role, job_result, Role.objects.all().count(), weight__isnull=True)
+
     def test_bulk_edit_select_some(self):
         """
         Bulk edit selected Namespace instances.

nautobot/core/tests/test_utils.py

@@ -1,3 +1,7 @@
+import os
+import os.path
+import sys
+import tempfile
 from unittest import mock
 import uuid
 
@@ -17,6 +21,11 @@ from nautobot.core.models import fields as core_fields, utils as models_utils, v
 from nautobot.core.testing import TestCase
 from nautobot.core.utils import data as data_utils, filtering, lookup, querysets, requests
 from nautobot.core.utils.migrations import update_object_change_ct_for_replaced_models
+from nautobot.core.utils.module_loading import (
+    check_name_safe_to_import_privately,
+    clear_module_from_sys_modules,
+    import_modules_privately,
+)
 from nautobot.dcim import filters as dcim_filters, forms as dcim_forms, models as dcim_models, tables
 from nautobot.extras import models as extras_models, utils as extras_utils
 from nautobot.extras.choices import ObjectChangeActionChoices, RelationshipTypeChoices
@@ -959,6 +968,190 @@ class TestMigrationUtils(TestCase):
             self.assertEqual(ObjectChange.objects.get(request_id=request_id).related_object_type, location_ct)
 
 
+class TestModuleLoadingUtils(TestCase):
+    def test_check_name_safe_to_import_privately(self):
+        for invalid in (
+            "foo.bar",  # not a valid identifier
+            "😂",  # not a valid identifier
+            "from",  # reserved keyword
+            "sys",  # Python builtin
+            "nautobot",  # installed package
+            "tkinter",  # system library
+        ):
+            with self.subTest(f"Invalid name: {invalid}"):
+                permitted, reason = check_name_safe_to_import_privately(invalid)
+                self.assertFalse(permitted)
+                self.assertIsInstance(reason, str)
+
+    def _create_test_files(self, root_directory: str, contents: dict):
+        """Helper function to create arbitrary text files in a given directory."""
+        for relative_path, file_contents in contents.items():
+            os.makedirs(os.path.dirname(os.path.join(root_directory, relative_path)), exist_ok=True)
+            with open(os.path.join(root_directory, relative_path), "wt") as fd:
+                fd.write(file_contents)
+
+    def test_import_modules_privately_jobs_root_case(self):
+        with tempfile.TemporaryDirectory() as tempdir:
+            try:
+                contents = {
+                    # Job file treated as a standalone module
+                    "some_jobs.py": 'name = "some_jobs"',
+                    # Job subdirectory treated as a package
+                    "my_jobs/__init__.py": '''\
+import my_jobs.some_submodule
+from . import relative_submodule
+name = "my_jobs"''',
+                    "my_jobs/some_submodule/__init__.py": 'name = "my_jobs.some_submodule"',
+                    "my_jobs/relative_submodule/__init__.py": 'name = "my_jobs.relative_submodule"',
+                    # Job file that shouldn't be loaded as it conflicts
+                    "tkinter.py": 'name = "tkinter"',
+                    # Job submodule that shouldn't be loaded as it conflicts
+                    "turtle/__init__.py": 'name = "turtle"',
+                }
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, ignore_import_errors=False)
+                self.assertEqual(["my_jobs", "some_jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "some_jobs" not in sys.modules:
+                    self.fail("Valid module wasn't loaded from JOBS_ROOT")
+                if "my_jobs" not in sys.modules:
+                    self.fail("Valid package wasn't loaded from JOBS_ROOT")
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["some_jobs"].name, "some_jobs")
+                self.assertEqual(sys.modules["my_jobs"].name, "my_jobs")
+                self.assertEqual(sys.modules["my_jobs"].some_submodule.name, "my_jobs.some_submodule")
+                # self.assertEqual(sys.modules["my_jobs"].relative_submodule.name, "my_jobs.relative_submodule")
+
+            finally:
+                clear_module_from_sys_modules("some_jobs")
+                clear_module_from_sys_modules("my_jobs")
+
+                self.assertNotIn("some_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs.some_submodule", sys.modules.keys())
+
+            # Test reloading of modules after code changes
+            try:
+                contents["some_jobs.py"] = 'name = "some_jobs_new"'
+                contents["my_jobs/__init__.py"] = '''\
+import my_jobs.some_submodule
+from . import relative_submodule
+name = "my_jobs_new"'''
+                contents["my_jobs/some_submodule/__init__.py"] = 'name = "my_jobs.some_submodule_new"'
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, ignore_import_errors=False)
+                self.assertEqual(["my_jobs", "some_jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "some_jobs" not in sys.modules:
+                    self.fail("Valid module wasn't loaded from JOBS_ROOT")
+                if "my_jobs" not in sys.modules:
+                    self.fail("Valid package wasn't loaded from JOBS_ROOT")
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from JOBS_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["some_jobs"].name, "some_jobs_new")
+                self.assertEqual(sys.modules["my_jobs"].name, "my_jobs_new")
+                self.assertEqual(sys.modules["my_jobs"].some_submodule.name, "my_jobs.some_submodule_new")
+
+            finally:
+                clear_module_from_sys_modules("some_jobs")
+                clear_module_from_sys_modules("my_jobs")
+
+                self.assertNotIn("some_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs", sys.modules.keys())
+                self.assertNotIn("my_jobs.some_submodule", sys.modules.keys())
+
+    def test_import_modules_privately_git_repo_jobs_case(self):
+        with tempfile.TemporaryDirectory() as tempdir:
+            try:
+                contents = {
+                    # Repo that we intend to load
+                    "my_repo/__init__.py": 'name = "my_repo"',
+                    "my_repo/jobs/__init__.py": '''\
+import my_repo.jobs.some_jobs
+from . import some_other_jobs
+name = "my_repo.jobs"''',
+                    "my_repo/jobs/some_jobs.py": 'name = "my_repo.jobs.some_jobs"',
+                    "my_repo/jobs/some_other_jobs.py": 'name = "my_repo.jobs.some_other_jobs"',
+                    # A separate repo, not intended to be loaded
+                    "other_repo/__init__.py": "",
+                    # File that shouldn't be loaded as it conflicts
+                    "tkinter.py": "",
+                    # Package that shouldn't be loaded as it conflicts
+                    "turtle/__init__.py": "",
+                }
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, module_path=["my_repo", "jobs"], ignore_import_errors=False)
+                self.assertEqual(["my_repo", "my_repo.jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "my_repo" not in sys.modules:
+                    self.fail("Valid repo wasn't loaded from GIT_ROOT")
+                if "my_repo.jobs" not in sys.modules:
+                    self.fail("Valid repo subdirectory wasn't loaded from GIT_ROOT")
+                with self.assertRaises(KeyError, msg="unexpected repo was loaded from GIT_ROOT"):
+                    sys.modules["other_repo"]
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["my_repo"].name, "my_repo")
+                self.assertEqual(sys.modules["my_repo.jobs"].name, "my_repo.jobs")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_jobs.name, "my_repo.jobs.some_jobs")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_other_jobs.name, "my_repo.jobs.some_other_jobs")
+
+            finally:
+                clear_module_from_sys_modules("my_repo")
+
+                self.assertNotIn("my_repo", sys.modules.keys())
+                self.assertNotIn("my_repo.jobs", sys.modules.keys())
+
+            # Test reloading of modules after code changes
+            try:
+                contents["my_repo/__init__.py"] = 'name = "my_repo_new"'
+                contents["my_repo/jobs/__init__.py"] = '''\
+import my_repo.jobs.some_jobs
+from . import some_other_jobs
+name = "my_repo.jobs_new"'''
+                contents["my_repo/jobs/some_jobs.py"] = 'name = "my_repo.jobs.some_jobs_new"'
+                contents["my_repo/jobs/some_other_jobs.py"] = 'name = "my_repo.jobs.some_other_jobs_new"'
+                self._create_test_files(tempdir, contents)
+
+                modules = import_modules_privately(tempdir, module_path=["my_repo", "jobs"], ignore_import_errors=False)
+                self.assertEqual(["my_repo", "my_repo.jobs"], sorted([module.__name__ for module in modules]))
+                # assertIn/assertNotIn are super noisy when dealing with the huge sys.modules dict, so instead:
+                if "my_repo" not in sys.modules:
+                    self.fail("Valid repo wasn't loaded from GIT_ROOT")
+                if "my_repo.jobs" not in sys.modules:
+                    self.fail("Valid repo subdirectory wasn't loaded from GIT_ROOT")
+                with self.assertRaises(KeyError, msg="unexpected repo was loaded from GIT_ROOT"):
+                    sys.modules["other_repo"]
+                with self.assertRaises(KeyError, msg="conflicting module name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["tkinter"]
+                with self.assertRaises(KeyError, msg="conflicting package name was loaded unsafely from GIT_ROOT"):
+                    sys.modules["turtle"]
+
+                self.assertEqual(sys.modules["my_repo"].name, "my_repo_new")
+                self.assertEqual(sys.modules["my_repo.jobs"].name, "my_repo.jobs_new")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_jobs.name, "my_repo.jobs.some_jobs_new")
+                self.assertEqual(sys.modules["my_repo.jobs"].some_other_jobs.name, "my_repo.jobs.some_other_jobs_new")
+
+            finally:
+                clear_module_from_sys_modules("my_repo")
+
+                self.assertNotIn("my_repo", sys.modules.keys())
+                self.assertNotIn("my_repo.jobs", sys.modules.keys())
+
+
 class TestQuerySetUtils(TestCase):
     def test_maybe_select_related(self):
         # If possible, select_related should be called

nautobot/core/tests/test_views.py

@@ -1,5 +1,7 @@
 import json
+import os
 import re
+import tempfile
 from unittest import mock, skipIf
 import urllib.parse
 
@@ -185,6 +187,77 @@ class HomeViewTestCase(TestCase):
         self.assertNotIn("Welcome to Nautobot!", response.content.decode(response.charset))
 
 
+class MediaViewTestCase(TestCase):
+    def test_media_unauthenticated(self):
+        """
+        Test that unauthenticated users are redirected to login when accessing media files whether they exist or not.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(
+                MEDIA_ROOT=temp_dir,
+                BRANDING_FILEPATHS={"logo": os.path.join("branding", "logo.txt")},
+            ):
+                file_path = os.path.join(temp_dir, "foo.txt")
+                url = reverse("media", kwargs={"path": "foo.txt"})
+                self.client.logout()
+
+                # Unauthenticated request to nonexistent media file should redirect to login page
+                response = self.client.get(url)
+                self.assertRedirects(
+                    response, expected_url=f"{reverse('login')}?next={url}", status_code=302, target_status_code=200
+                )
+
+                # Unauthenticated request to existent media file should redirect to login page as well
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+                response = self.client.get(url)
+                self.assertRedirects(
+                    response, expected_url=f"{reverse('login')}?next={url}", status_code=302, target_status_code=200
+                )
+
+    def test_branding_media(self):
+        """
+        Test that users can access branding files listed in `settings.BRANDING_FILEPATHS` regardless of authentication.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(
+                MEDIA_ROOT=temp_dir,
+                BRANDING_FILEPATHS={"logo": os.path.join("branding", "logo.txt")},
+            ):
+                os.makedirs(os.path.join(temp_dir, "branding"))
+                file_path = os.path.join(temp_dir, "branding", "logo.txt")
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+
+                url = reverse("media", kwargs={"path": "branding/logo.txt"})
+
+                # Authenticated request succeeds
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+                # Unauthenticated request also succeeds
+                self.client.logout()
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+    def test_media_authenticated(self):
+        """
+        Test that authenticated users can access regular media files stored in the `MEDIA_ROOT`.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(MEDIA_ROOT=temp_dir):
+                file_path = os.path.join(temp_dir, "foo.txt")
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+
+                url = reverse("media", kwargs={"path": "foo.txt"})
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+
 @override_settings(BRANDING_TITLE="Nautobot")
 class SearchFieldsTestCase(TestCase):
     def test_search_bar_redirect_to_login(self):

nautobot/core/tests/test_views_utils.py

@@ -1,13 +1,16 @@
 import urllib.parse
 
+from django.contrib.auth.models import AnonymousUser
 from django.db import ProgrammingError
 from django.test import TestCase
 
 from nautobot.core.models.querysets import count_related
-from nautobot.core.views.utils import check_filter_for_display, prepare_cloned_fields
+from nautobot.core.testing import TransactionTestCase
+from nautobot.core.views.utils import check_filter_for_display, get_saved_views_for_user, prepare_cloned_fields
 from nautobot.dcim.filters import DeviceFilterSet
 from nautobot.dcim.models import Device, DeviceRedundancyGroup, DeviceType, InventoryItem, Location, Manufacturer
-from nautobot.extras.models import Role, Status
+from nautobot.extras.models import Role, SavedView, Status
+from nautobot.users.models import User
 
 
 class CheckFilterForDisplayTest(TestCase):
@@ -168,3 +171,51 @@ class CheckPrepareClonedFields(TestCase):
                 self.assertTrue(isinstance(query_params["description"], list))
                 self.assertTrue(len(query_params["description"]) == 1)
                 self.assertTrue(query_params["description"][0] == description)
+
+
+class GetSavedViewsForUserTestCase(TransactionTestCase):
+    """
+    Class to test `get_saved_views_for_user`.
+    """
+
+    def create_saved_view(self, name, owner=None, is_shared=False):
+        """Helper to create a SavedView."""
+        return SavedView.objects.create(
+            name=name, owner=owner or self.user, view="dcim:device_list", is_shared=is_shared
+        )
+
+    def setUp(self):
+        super().setUp()
+        self.user2 = User.objects.create_user(username="second_user")
+        self.create_saved_view(name="saved_view")
+        self.create_saved_view(name="saved_view_shared", is_shared=True)
+        self.create_saved_view(name="saved_view_different_owner", owner=self.user2)
+        self.create_saved_view(name="saved_view_shared_different_owner", is_shared=True, owner=self.user2)
+
+    def test_user_with_permissions_get_all_saved_views(self):
+        """Test if for user with permissions method will return all saved views."""
+        self.add_permissions("extras.view_savedview")
+        saved_views = get_saved_views_for_user(self.user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 4)
+        expected_names = [
+            "saved_view",
+            "saved_view_different_owner",
+            "saved_view_shared",
+            "saved_view_shared_different_owner",
+        ]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)
+
+    def test_user_without_permissions_get_shared_views_and_own_views_only(self):
+        """Test if user without permissions can see shared views and own views."""
+        saved_views = get_saved_views_for_user(self.user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 3)
+        expected_names = ["saved_view", "saved_view_shared", "saved_view_shared_different_owner"]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)
+
+    def test_anonymous_user_get_shared_views_only(self):
+        """Test if method is working with anonymous users and return only shared views."""
+        user = AnonymousUser()
+        saved_views = get_saved_views_for_user(user, "dcim:device_list")
+        self.assertEqual(saved_views.count(), 2)
+        expected_names = ["saved_view_shared", "saved_view_shared_different_owner"]
+        self.assertEqual(list(saved_views.values_list("name", flat=True)), expected_names)

nautobot/core/ui/object_detail.py

@@ -1266,6 +1266,10 @@ class ObjectFieldsPanel(KeyValueTablePanel):
 
             data[field_name] = field_value
 
+        # Ensuring the `name` field is displayed first, if present.
+        if "name" in data:
+            data = {"name": data["name"], **{k: v for k, v in data.items() if k != "name"}}
+
         return data
 
     def render_key(self, key, value, context: Context):

nautobot/core/urls.py

@@ -2,13 +2,13 @@ from django.conf import settings
 from django.http import HttpResponse, HttpResponseNotFound
 from django.urls import include, path
 from django.views.generic import TemplateView
-from django.views.static import serve
 
 from nautobot.core.views import (
     AboutView,
     CustomGraphQLView,
     get_file_with_authorization,
     HomeView,
+    MediaView,
     NautobotMetricsView,
     NautobotMetricsViewAuth,
     RenderJinjaView,
@@ -51,7 +51,7 @@ urlpatterns = [
     # GraphQL
     path("graphql/", CustomGraphQLView.as_view(graphiql=True), name="graphql"),
     # Serving static media in Django (TODO: should be DEBUG mode only - "This view is NOT hardened for production use")
-    path("media/<path:path>", serve, {"document_root": settings.MEDIA_ROOT}),
+    path("media/<path:path>", MediaView.as_view(), name="media"),
     # Admin
     path("admin/", admin_site.urls),
     # Errors

nautobot/core/utils/lookup.py

@@ -314,13 +314,15 @@ def get_created_and_last_updated_usernames_for_model(instance):
     created_by = None
     last_updated_by = None
     try:
-        created_by_record = object_change_records.filter(action=ObjectChangeActionChoices.ACTION_CREATE).first()
+        created_by_record = (
+            object_change_records.filter(action=ObjectChangeActionChoices.ACTION_CREATE).only("user_name").first()
+        )
         if created_by_record is not None:
             created_by = created_by_record.user_name
     except ObjectChange.DoesNotExist:
         pass
 
-    last_updated_by_record = object_change_records.first()
+    last_updated_by_record = object_change_records.only("user_name").first()
     if last_updated_by_record:
         last_updated_by = last_updated_by_record.user_name