Use RBAC for accept_risks API endpoints #14632
Open
Jino-T wants to merge 2 commits intoDefectDojo:bugfixfrom
Open
Use RBAC for accept_risks API endpoints #14632Jino-T wants to merge 2 commits intoDefectDojo:bugfixfrom
Jino-T wants to merge 2 commits intoDefectDojo:bugfixfrom
Conversation
Replace DRF's IsAdminUser permission with DefectDojo's RBAC system on all accept_risks endpoints. IsAdminUser only checked is_staff, bypassing role-based access control entirely. - Use UserHasRiskAcceptanceRelatedObjectPermission for detail endpoints (engagement/test accept_risks) to enforce Permissions.Risk_Acceptance - Change mass endpoint to query engagements with Risk_Acceptance permission instead of Engagement_View - Enforce product-level enable_full_risk_acceptance setting on all accept_risks endpoints - Add 9 RBAC unit tests covering writer/reader roles and the enable_full_risk_acceptance product setting Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Maffooch
force-pushed
the
accept-risk-api-fix
branch
from
d359802 to
fe64ee1
Compare
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Maffooch
changed the title
Maffooch
approved these changes
Apr 14, 2026
Maffooch
requested review from
blakeaowens,
mtesauro,
paulOsinski and
valentijnscholten
and removed request for
mtesauro
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
accept_risks API endpoints, aligning them with how risk acceptance is authorized everywhere else in the
application
the behavior of the UI views
Permissions.Risk_Acceptance instead of Permissions.Engagement_View