Cannot add Prefix w/ restricted permissions

[jeremypng]

An issue has cropped up on Netbox 2.11.9 where users cannot add a prefix and get the following error when clicking the add prefix button, not the save button. So I'm guessing the permissions error is related to the site, but I can't figure out how to track this down. I relaxed the site permissions to not include a constraint and that doesn't fix the problem. But making them a super user does. Any advice on how to track this down to the exact issue?

Environment:

Request Method: GET
Request URL: https://netbox.xyz.com/ipam/prefixes/add/

Django Version: 3.2.5
Python Version: 3.6.8
Installed Applications:
['django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'django.contrib.humanize',
'cacheops',
'corsheaders',
'debug_toolbar',
'django_filters',
'django_tables2',
'django_prometheus',
'mptt',
'rest_framework',
'taggit',
'timezone_field',
'circuits',
'dcim',
'ipam',
'extras',
'secrets',
'tenancy',
'users',
'utilities',
'virtualization',
'django_rq',
'drf_yasg',
'netbox_site_onboarding.SiteOnboardingConfig']
Installed Middleware:
['debug_toolbar.middleware.DebugToolbarMiddleware',
'django_prometheus.middleware.PrometheusBeforeMiddleware',
'corsheaders.middleware.CorsMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.middleware.security.SecurityMiddleware',
'netbox.middleware.ExceptionHandlingMiddleware',
'netbox.middleware.RemoteUserMiddleware',
'netbox.middleware.LoginRequiredMiddleware',
'netbox.middleware.APIVersionMiddleware',
'netbox.middleware.ObjectChangeMiddleware',
'django_prometheus.middleware.PrometheusAfterMiddleware']

Traceback (most recent call last):
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/core/handlers/exception.py", line 47, in inner
response = get_response(request)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/core/handlers/base.py", line 181, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/views/generic/base.py", line 70, in view
return self.dispatch(request, *args, **kwargs)
File "/opt/netbox/netbox/netbox/views/generic.py", line 258, in dispatch
return super().dispatch(request, *args, **kwargs)
File "/opt/netbox/netbox/utilities/views.py", line 93, in dispatch
return super().dispatch(request, *args, **kwargs)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/views/generic/base.py", line 98, in dispatch
return handler(request, *args, **kwargs)
File "/opt/netbox/netbox/netbox/views/generic.py", line 265, in get
restrict_form_fields(form, request.user)
File "/opt/netbox/netbox/utilities/forms/utils.py", line 136, in restrict_form_fields
field.queryset = field.queryset.restrict(user, action)
File "/opt/netbox/netbox/utilities/querysets.py", line 42, in restrict
qs = self.filter(attrs)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/query.py", line 941, in filter
return self._filter_or_exclude(False, args, kwargs)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/query.py", line 961, in _filter_or_exclude
clone._filter_or_exclude_inplace(negate, args, kwargs)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/query.py", line 968, in _filter_or_exclude_inplace
self._query.add_q(Q(*args, **kwargs))
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1393, in add_q
clause, _ = self._add_q(q_object, self.used_aliases)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1415, in _add_q
split_subq=split_subq, check_filterable=check_filterable,
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1272, in build_filter
check_filterable=check_filterable,
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1415, in _add_q
split_subq=split_subq, check_filterable=check_filterable,
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1286, in build_filter
lookups, parts, reffed_expression = self.solve_lookup_type(arg)
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1112, in solve_lookup_type
_, field, _, lookup_parts = self.names_to_path(lookup_splitted, self.get_meta())
File "/opt/netbox-2.11.9/venv/lib64/python3.6/site-packages/django/db/models/sql/query.py", line 1540, in names_to_path
"Choices are: %s" % (name, ", ".join(available)))

Exception Type: FieldError at /ipam/prefixes/add/
Exception Value: Cannot resolve keyword 'site' into field. Choices are: created, custom_field_data, description, id, last_updated, name, scope, scope_id, scope_type, scope_type_id, slug, vlans

[sdktr]

In my experience a lack of permissions on referenced models (like site, vlan on your prefix model) doesn't render an error but simply shows an empty dropdown when selecting that item.

[candlerb]

Exception Type: FieldError at /ipam/prefixes/add/
Exception Value: Cannot resolve keyword 'site' into field.

Have you got any permission rules set on 'prefix' for view, add, and/or change? If so, can you share the rules?

The implication is that it's trying to resolve the word "site" into something, e.g.

{'foo__site': 'bar'}

where "foo" is some other object class which doesn't have a "site" attribute. (But prefix itself does have a site attribute)

[jeremystretch]

Exception Value: Cannot resolve keyword 'site' into field. Choices are: created, custom_field_data, description, id, last_updated, name, scope, scope_id, scope_type, scope_type_id, slug, vlans

These fields belong to the VLANGroup model. It would help to share exactly what values you're setting to trigger the error.

[jeremypng]

That's it. This is the constraint on the vlan group:
{"site__tenant__slug": "sw-region"}

[jeremypng]

That's a bad permission on the vlan group since there isn't a site field associated with it all the time right?

[jeremystretch]

Right, IIRC this changed in v2.11.0, with the addition of the "scope" concept for VLAN groups. Direct assignment via a site attribute is no longer supported.

[sdktr]

So in some/this case(s), opening a page preloads the dropdown instead of on the fly api calls? Or is there some kind of pre-render that doesn't load data but validates the queryfilters?

In eighter case, should error handling be improved or is this the intended behavior for bad rbac contraints?

[DanSheps]

I think it might be reasonable to raise a more explanatory error.