Permisson to view secrets does not work

[marendres]

Environment

• Python version: 3.5.2
• NetBox version: 2.5.5

Detailed Description

We are using secrets to store passwords and they are only available for users with the superuser flag. Normal users are not permitted to decrypt and view them, even if they have been granted all permissions (which should be the same as the superuser status). It is possible for normal users to create and delete secrets and also possible to strip them from those permissions, but they can not view them, even if they created the secret themselves.

Steps to Reproduce

1. create secret
2. login as user with permissions to view secrets, but no superuser
3. try to open/display secret

decrypt and display the secret

"You do not have permission to decrypt this secret."

[jeremystretch]

The view permissions were introduced in Django 2.1 and are not yet used by NetBox. Please see the v2.5 release notes. The error message is displayed because the user does not have an active user key for decryption.

[apallier]

Hi, I have the same issue with Netbox 2.6.6.

Behavior observed:

• Only a superuser can decrypt password everywhere.
• At "view" screen, a "normal" user can't decrypt even if her user key is active (gray "Unlock" button).
• The only way for a "normal" user to see a secret is to go at the "editing" screen ("Edit this secret" button). Here, the password can be decrypted (green "Unlock" button).

Is it the expected behavior?

[DanSheps]

First, upgrade to the latest stable

Second, if you experience the same issue, provide reproducible steps here for us to follow. If it is a slightly different issues please open a new issue following one of the templates

[marendres]

Upgraded to the latest stable version (2.7.4) but the problem still persists. It is the same problem @apallier seems to have. A user can have all permissions but is not able to decrypt secrets in the device overview, only in the editing screen of the secret itself.
On the device overview the "Unlock" is grey and there is an alttext "Permission denied" if you hoover over it.