ScriptViewSet REST API allows unauthorized DELETE/PUT/PATCH

[arthanson]

NetBox Edition

NetBox Community

NetBox Version

v4.6.5

Python Version

3.12

Steps to Reproduce

1. Create a user with only the extras.view_script permission (no delete_script/change_script).
2. As that user, send DELETE /api/extras/scripts/{id}/ for any existing script.
3. Separately, create an API token with write_enabled=False (read-only) for a user who can manage scripts.
4. Using that read-only token, send DELETE /api/extras/scripts/{id}/ (or PUT/PATCH).

Expected Behavior

A view_script-only user and a read-only token should both receive 403 Forbidden on DELETE/PUT/PATCH /api/extras/scripts/{id}/.

Observed Behavior

Both requests succeed with 204 No Content and the Script row is hard-deleted from the database (PUT/PATCH similarly mutate it).

Notes

• ScriptViewSet uses permission_classes = [IsAuthenticatedOrLoginNotRequired], which checks authentication only. TokenPermissions/TokenWritePermission are never applied, so write_enabled=False isn't enforced on unsafe methods.
• initial() maps every non-POST method to the view action, and there's no destroy()/update() override or delete_script/change_script check - so a view_script-only user passes every guard on the destructive routes.
• The prior read-only-token fix covered only the POST/run path; DELETE/PUT/PATCH remain unguarded.