Fixes #20442: Mark template-accessible methods with alters_data=True #355

New Issue

MrUnknownDE · 2026-04-05T16:27:05+02:00

MrUnknownDE commented

2026-04-05 16:27:05 +02:00

Originally created by @jnovinger on 2/13/2026

Fixes: #20442

Add alters_data=True to methods that modify database or filesystem state and are accessible from Jinja2 sandbox template contexts (config templates, export templates, webhooks, custom links).

Methods protected:

UserConfig.set(), clear() - Persist preference changes when commit=True
ManagedFile.sync_data() - Writes files to scripts/reports storage
ScriptModule.sync_classes(), sync_data() - Creates/deletes Script objects
Job.start(), terminate() - Updates job status, creates notifications

Methods intentionally not protected:

DataFile.refresh_from_disk() - Only modifies instance attributes in memory, doesn't persist
Overridden save()/delete() - Django's AltersData mixin auto-propagates from parent
Properties like Script.python_class - Not callable in template context

Ref: #20356 for exploit details

*Originally created by @jnovinger on 2/13/2026* Fixes: #20442 Add `alters_data=True` to methods that modify database or filesystem state and are accessible from Jinja2 sandbox template contexts (config templates, export templates, webhooks, custom links). ### Methods protected: - `UserConfig.set()`, `clear()` - Persist preference changes when `commit=True` - `ManagedFile.sync_data()` - Writes files to scripts/reports storage - `ScriptModule.sync_classes()`, `sync_data()` - Creates/deletes Script objects - `Job.start()`, `terminate()` - Updates job status, creates notifications ### Methods intentionally not protected: - `DataFile.refresh_from_disk()` - Only modifies instance attributes in memory, doesn't persist - Overridden `save()`/`delete()` - Django's `AltersData` mixin auto-propagates from parent - Properties like `Script.python_class` - Not callable in template context Ref: #20356 for exploit details

MrUnknownDE closed this issue

2026-04-05 16:27:05 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#355