Rendering the SSO buttons as POST forms (#23042) made every SSO login a form
submission which NetBox answers with a redirect to the identity provider.
Chromium-based browsers evaluate the CSP form-action directive against every hop
in a form submission's redirect chain, so a deployment which serves NetBox with
`form-action 'self'` blocks that redirect and the button silently does nothing.
Add SocialAuthBeginView, which wraps python-social-auth's begin view and returns
the identity provider's URL as JSON to clients which request it. The login page
now submits the form via fetch() and assigns window.location, which form-action
does not govern. The upstream view is reused as-is, so CSRF protection, the
callback URL, and the session state recorded for the identity provider are
unchanged; clients which do not request JSON (a browser without JavaScript, or a
backend which renders an HTML form rather than redirecting) receive the
unmodified response as before.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The sanitization tests used `assertInHTML`, which checks containment. Each
needle happened to span the whole output, so they passed, but a payload
surviving outside the `rendered-markdown` div would not have failed them.
`assertHTMLEqual` is what the docstring already claimed these tests did.
`JSONSchemaProperty.to_form_field()` assigned a schema property's description
directly to the form field's `help_text`, which `form_helpers/render_field.html`
renders through the safe filter. Any element a module type profile schema
author put in a property description reached the DOM intact, including ones
outside `HTML_ALLOWED_TAGS`.
Pass the description through `render_markdown()`, which applies the allowlist
via `clean_html()` before `mark_safe()`. This matches how custom field
descriptions are handled in `CustomField.to_form_field()`, so both kinds of
user-defined attribute render their help text the same way.
Descriptions stored since v4.3.0 are now interpreted as Markdown, so one
beginning with "#" renders as a heading and one beginning with "1." renders
as a list item. Custom field descriptions took the same change in #12685.
Sanitizing inside `to_form_field()` rather than at the call site in
`dcim/forms/model_forms.py` means plugins calling this utility are covered too.
Add a 2X (two-lane) InfiniBand group for HDR and later generations, covering
the HDR100, NDR200, and XDR400 breakout links formed by splitting a four-lane
port into two independent two-lane links.
SDR through EDR are omitted deliberately: two-lane breakout only became a
shipping configuration once per-lane rates reached 50 Gbps, so there are no
corresponding products at those generations.
The existing tests assert on filter results, which stay correct for ASCII values
even when the collation is never applied. Add a test which asserts on the
lookup's own compiled output, so that the mechanism failing open is caught
rather than passing silently.
Explain why the placeholder is compared literally: a field declaring its own
get_placeholder() compiles to something other than '%s', and splicing a COLLATE
clause into that is not safe, so any other right-hand side is left alone.
The documentation note described the folding as specific to the German
eszett. It is the common example rather than the rule: the collation treats a
character as equivalent to the sequence it expands to in upper case, which also
covers ligatures. Note too that a case-insensitive exact match on a collated
field may now return more than one object.
Django's PostgreSQL backend compiles icontains, iexact, istartswith and
iendswith as UPPER(col::text) LIKE UPPER(%s). UPPER() folds according to the
collation of its argument, and the two sides do not share one: the column folds
under its own collation while the parameter folds under the database default.
For a column using natural_sort, UPPER('ß') is 'SS' on the left and 'ß' on the
right, so searching for 'ß' matched nothing. This affects the name field of most
models and all four case-insensitive lookups, which are also exposed through the
REST API as __ic, __ie, __isw and __iew.
Apply the column's collation to the parameter as well, inside the UPPER() call,
so that both sides fold the same way. Matching on those fields becomes
bidirectional, so 'Strasse' finds 'Straße' and vice versa. Fields without the
collation are unchanged.
The lookups only collate a bare column compared against a simple value. An
expression which already carries an explicit collation, such as Collate() or
CollateAsChar(), would otherwise raise a collation mismatch error.
Cable.save() recomputed _abs_length in memory but never added it to
update_fields, so a save naming length or length_unit left the stored
normalized value stale. Derive it from the values the row will hold
after the save and persist it alongside its source fields.
Fixes#23096
Add FILTER_ARRAY_BASED_LOOKUP_MAP to maintain 'contains' lookup under
negation for MultiValueArrayFilter, preventing fallback to exact match.
Negation now correctly excludes objects whose array contains the value
rather than matching it exactly.
Fixes#23117
Validate REST script input before enqueueing jobs. Resolve ObjectVar
IDs to model instances and MultiObjectVar IDs to querysets, returning
HTTP 400 with errors nested under data when validation fails.
Share form preparation between the API and UI, including multi-value
defaults, while keeping validation out of the job runner to preserve
other execution paths. Exclude only known execution fields from script
data and prevent _notifications from leaking into CLI script input.
Document the REST compatibility changes, including required-field
validation and discarded undeclared keys. Add regression coverage for
object resolution, defaults, validation errors, and execution options.
Co-authored-by: Martin Burggraf <martin.burggraf@netclusive.com>
* fix(dcim): Prevent path rebuild when Cable Terminations unchanged
Compare Cable Terminations against stored values instead of the empty
cache when checking for modifications, so a freshly loaded Cable that is
resaved with the same terminations no longer rebuilds its paths. Raise
the flag whenever update_terminations() force-recreates an end, since
the edit form warms the cache that gated it and a profile change then
tore every path down without rebuilding it. Add regression tests for
both.
Fixes#23097
* fix(dcim): Preserve cable end order when terminations unchanged
Compare cable terminations against stored values instead of potentially
stale prefetched relations when checking for modifications. Skip setting
terminations in the form's clean() when a saved cable's members are
unchanged, preserving the connector order assigned by the profile.
Does two things:
1. Adds a regression test to ensure that the `extras_scripts_run`
operation is always present in contrib/openapi.json. This has
regressed at least once since original implementation, so I wanted to
make sure we catch it quickly in the future.
2. Overrides the Django `CACHES` setting for the OpenAPISchemaTestCase,
which contains the new test, so that caching of the schema is
disabled. This caused problems by masking whether or not the
regression test (and other existing tests) were failing/succeeding in
response to changes or not.
RQQueueTestMixin cleared RQ queues with FLUSHALL, which empties every
database on the Redis server — including the caching database, whose
'config'/'config_version' keys are shared by all parallel test workers.
A flush landing mid-test forces an unrelated worker to re-read
core_configrevision, adding two queries to the affected request. Flush
only the queue's own database instead.
Also stop GraphQLDeferredColumnTestCase from comparing total query counts
between two requests, which is what surfaced the race as intermittent
"Query count grew from 7 to 9" failures in CI. Assert that the target
table is read exactly once per request instead, as #23034 did for the
equivalent custom fields test.
Set `_terminations_modified` flag when recreating terminations to ensure
paths are rebuilt even when endpoints remain unchanged.
Reset `_orig_status`, `_orig_profile`, and `_terminations_modified`
after saving a cable to prevent repeated saves from recreating
terminations and paths.
Add comprehensive test coverage for profile changes, trunk regrouping,
and mid-span cables.
Validate the effective timeout and notification settings at the
ScriptJob enqueue boundary so invalid script configuration is reported
consistently across all execution paths instead of raising an unhandled
exception.
Preserve the inherited positional enqueue contract and prevent tests
from interfering through shared RQ queue state during parallel runs.
Introduces normalize_update_fields() utility to materialize one-shot
iterables like generators into frozensets, preventing bugs in save()
overrides that perform membership tests. Fixes channelization cascades,
module moves, and ltree parent tracking when using generator
expressions.
Fixes#23074
Recognize Django's ManyToManyRel in get_prefetches_for_serializer().
Because it is a sibling of ManyToOneRel rather than a subclass, reverse
many-to-many accessors were omitted from the generated prefetch paths and
fetched once per serialized object.
Add regression coverage for both automatically generated fields and
SerializedPKRelatedField(many=True), and regenerate the affected ASN and
ObjectPermission API query-count baselines.
Fixes#23060
Introduce `normalize_update_fields()` utility to convert update_fields
to frozenset, preventing one-shot iterables from being consumed during
membership tests. Update Service, VLANGroup, and CircuitTermination
save methods to use normalized fields. Add comprehensive test coverage.
Fixes generator exhaustion when save() overrides check field membership
before persisting denormalized caches alongside their source fields.
Fixes#23078
Move scope assignment before validation to prevent stale scope values
on instances when validation fails. Refactor VLANGroupForm to inherit
from ScopedForm, removing duplicate scope handling code. Add test
coverage for scope type changes and validation errors.
Fixes#23040
github-actions
Jeremy Stretch
Jason Novinger
bctiemann
Martin Hauser
Arthur Hanson