From 3599dc703ee9ade850187ef3febd90d9f4481c98 Mon Sep 17 00:00:00 2001
From: Louis <louis@alexander-kerst.de>
Date: Wed, 29 Jul 2026 11:04:46 +0200
Subject: [PATCH] fix: restrict license email notification settings

---
 CHANGELOG.md                                  |   1 +
 README.md                                     |   4 +++
 netbox_slm/__init__.py                        |   2 +-
 netbox_slm/api/serializers.py                 |  10 ++++++
 netbox_slm/locale/de/LC_MESSAGES/django.mo    | Bin 8144 -> 8583 bytes
 netbox_slm/locale/de/LC_MESSAGES/django.po    |   9 +++++
 ...relicense_email_notification_permission.py |  23 +++++++++++++
 netbox_slm/models.py                          |   3 ++
 netbox_slm/views/software_license.py          |  31 ++++++++++++++++--
 9 files changed, 79 insertions(+), 4 deletions(-)
 create mode 100644 netbox_slm/migrations/0014_softwarelicense_email_notification_permission.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f936636..bad843f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@
 * Bump the package version so Git/Pip upgrades replace older installations
 * Make the license type field optional
 * Show the plugin under Licences in the main menu
+* Restrict SMTP notification activation to administrators and explicitly authorized users
 
 ## [1.9.0](https://github.com/ICTU/netbox_slm/releases/tag/1.9.0) - 2026-06-25
 
diff --git a/README.md b/README.md
index dc8d615..04974ec 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,10 @@ Die NetBox-Nachricht wird immer erzeugt. Wird an der Lizenz zusätzlich **E-Mail
 das Plugin auch eine E-Mail an die im Benutzerkonto hinterlegte Adresse. Dafür muss der SMTP-Versand in NetBox
 konfiguriert sein.
 
+Die Aktivierung des E-Mail-Versands darf nur durch Administratoren oder Benutzer mit der Berechtigung
+`netbox_slm.manage_softwarelicense_email_notifications` geändert werden. Die eigentlichen SMTP-Zugangsdaten werden
+ausschließlich in der NetBox-Serverkonfiguration gepflegt und sind im Plugin nicht einsehbar.
+
 Die Prüfung läuft einmal täglich als NetBox-Systemjob. Der NetBox-RQ-Worker muss daher mit Scheduler-Unterstützung
 laufen; dies ist bei der regulären NetBox-Installation mit `rqworker` standardmäßig der Fall. Das interne
 Versandprotokoll verhindert doppelte Nachrichten.
diff --git a/netbox_slm/__init__.py b/netbox_slm/__init__.py
index e0530f8..6fa668e 100644
--- a/netbox_slm/__init__.py
+++ b/netbox_slm/__init__.py
@@ -17,7 +17,7 @@ limitations under the License.
 from netbox.plugins import PluginConfig
 from django.utils.translation import gettext_lazy as _
 
-__version__ = "1.12.0"
+__version__ = "1.12.1"
 
 
 class SLMConfig(PluginConfig):
diff --git a/netbox_slm/api/serializers.py b/netbox_slm/api/serializers.py
index 1327ef7..5ef5a6b 100644
--- a/netbox_slm/api/serializers.py
+++ b/netbox_slm/api/serializers.py
@@ -54,6 +54,16 @@ class SoftwareLicenseSerializer(NetBoxModelSerializer):
         return f"{obj}"
 
     def validate(self, attrs):
+        request = self.context.get("request")
+        if (
+            "email_notifications" in attrs
+            and request is not None
+            and not request.user.has_perm("netbox_slm.manage_softwarelicense_email_notifications")
+        ):
+            raise serializers.ValidationError(
+                {"email_notifications": _("You do not have permission to change email notifications.")}
+            )
+
         tenant_group = attrs.get("tenant_group", getattr(self.instance, "tenant_group", None))
         tenant = attrs.get("tenant", getattr(self.instance, "tenant", None))
         if tenant_group and tenant and tenant.group_id != tenant_group.pk:
diff --git a/netbox_slm/locale/de/LC_MESSAGES/django.mo b/netbox_slm/locale/de/LC_MESSAGES/django.mo
index ac4b17ce4428f94b23fa5da6bb457f6e377dad16..e807294b075c84530ae53901e85884e8cadae82e 100644
GIT binary patch
delta 2680
zcmaLXeQXp(7{~FkoaIG?7AW%0A{4=vrrMTLLL|@v*0!KE!5UM@_PXt@z1ypMdx%wf
zi3y+x7~%^AiKYP|QcVnvpa_y!1pkmo6EXY)iH-O|NCOz7Q3-y3WexseY_9j&*`0aj
zd1hws?BdOpnTum0Zy5fz@IQtBctkB@jt#qQF_*__FT(*Gf~CWa8H)?>POL=@t;gB;
z1P;YcRNPIt1oxu)UBYR`WXxqQ?&8Mq5yoU=9%}9>n2Y(ChvldV>rjDh9EC1U!1Xv9
zcZBUOyqoq>RJ<=y@%wNjp2u?LH<!3j$Ejqo5DRbywx9;Sg!kbNR05x%COU&k-~#60
z6;$9G$j6MJq4DEU&!?j*FGfD5jIV6wH%r3@)tE(lC9cB9!uwr#5AFRp2S39a{1NA3
z3E3;5M$}3qP%F0y>0)+;zKi$MK7>l>0%pp%7~nzyW>L-pEX6uZpepzjHQ*$U!E-nj
zf5Jk{X0V=@pzc?p5@|vu@;uVjY(o~?>_I-}z-ZQAdwGPGmi`24iT*&{zlqwjp+r|D
zqfiM<MjfUitj2cKxTC0XC$Jt*qY9Wr7KAc0QHQl8v?7=F*J)nNjS8$p1=xTZxDj=F
zx1-KPH*#vt8PpzMK_&P*@-a90(izDmOI4hYnz$6TB2~y@n?~f^o3;!WnkbE`uoE@#
zm9V`VHPHd27}FEpKZ&Zi4>jSp;r+{@zoGg^c&N8057jO}CAuhVXI65dJzI;aYy&FO
zJvb3RLJjyDwRhj4D!PJv%wK$I#d5~oT8Rm$LZ+h<EJQtj05z@xk6<+x>;1oj^j2}>
zK~$wLq7vAS+N%SoKp)_IJcJ7PGg73vhD$Lr{#L&gIE!{IDv@VUThxh)zY#TV2Ts)c
zzi;q@*9x^K=TRN|QHczM?V-GbYL7)#Qi$rm2-SZ%YQlOf#kHudd>tRcy*Ly5QCpr(
zusM4FM{}V73s8rn3I_wB_H1qVygh8cfC{h;mB^c@721#5qHa{hhr|2FLqEqx?w>}j
zY(D#&nao827x}mX*I)u?<5#E(enFBpS(A8`a1vi?mm#Zf>aYZ($hMlDScUJS3c7|h
zcoS=}hDlYxuF0&wCg|dZ0)2?n@f4Qh52y;K@eXonijdtfkDyk@MshPgs`9O<E!l}W
zBVD*0-$Sj?Rn*@98a^L3mG##IIlKZo%@$T;Db`~r>i3}!74RHBg%?m0Rq)CvU?pnF
zSEH7;5%p6Z#Y${JjX#J=^bl&?@eCKL_$=zwUPbMF9yb;6UR1}qs7e>1&dTc0CS*H}
zhbm+<4z56G7b;$N=*Ot>U!Ybn)5nDd_M<Ypj#{c4sEM<zTYH^{+M;==J+4IkA~vA5
zumctFWmLS~s4Y8)ES5Qi+Pd#i3IB=ouQB6@qKWfSnHQrD%|g_YJskQdDsTg8OJd>u
zI4aR##%o)Ky`67+R>Jn|R>z9FQO8R;mXomExaB1Sx5bUxft&PFJ+p^DJ)~xp7k|#O
zn-i|*rUKs%l77lc`j)f4ouO`^hv^`e^xY1p*-EDz9!CiujoBXIgP5DLQce)KUTaa$
zt0QwG6;CG9R&!EQSuuN^W3@Ye!cC=^(F&6PjQfvtihAD3nID;7V|$*pY+fDd&Rgnu
zb~NU@(OBTNrkT&PT6&N9RxQbRe5`ej|EwJk9Ixk_aT|xMS()~&CI2pkF3D!cr-W3q
z-+L_DMolrR$?=`Rkbz?{MLOu9OIz<@&!c~{>#$tQTrU+k@i>!Oz56_3ctt%86W)qc
gKJGfy)kM!W$MqB-3`W<&|4F<feLK+gDHpT;1||k&Hvj+t

delta 2242
zcmYM!eQ1?c9Ki9@cC)F?yDe>RH^=PS)|)M_=A2|?D&@5XW=OOx&_K}$R$v*dJJ*YU
zwB}4!7HKZ%O-Wdn5DXo?NsJmJdRc-Z?2l+cjLi!35Bq-SfyUkaoaa2xIp_ELo%7s1
z_l?|>J6D$I3;gZjKgIvXgjfInbr*%uz~yVW22WujCT50k9Twr$m_mmxz-zD$o$n63
z7uU!8Jvg81{Wv>>T=<m63_4CBbBAxR6o+vho<|q@8=ZL8tPtj48CGB|Cb21Auft-l
zx1jU2qw_zH*WzwmhCNu!`r$N<COUq^T1*m_1MkE-Y(fLrj4rej4d4|l!9H~250FpD
z^X2$K^!~SKWqw7UJBJ4JhyAP{CTSGlKiG`_dIQ(-bU8L-J#NLDu@?>G1X_V1v|?k(
zC;SyHpbWQgokRm^!ljr+$M42mBaMAD9>gIu@(R*(KrNQxV!Q#@;BB}i-tUe5{b(SA
zXdt7=Cyet&QNu-a!31A!;as%hsU-C`(@pV43tE~d&`frq0X&BuqF3<&{2m=wPLxiV
z!VQ>46L=PRBy^&Ovp4z%dU)SK#~m)A{tozv4o~X<dIpBkQ#yg{Mo5yDfmNd!F5t^E
zu>{TZessZ2XeG8H#SERuxeYz&ItS3i`q6R6a<Stiy3i1^X81Yw|AuCI0bTH7>@TJ)
zPE>_HUx&Uejq&;+<k9eWylzLgunSG>FdArXkVYkqQFOp0x@QSiGovKBa1CFUEQ3~J
z1scFAG{EL~e<M1s1&`yC*nsJ|R}S|hXrk{U0p!8}4fkjWooEDI=qDtWa28kLM7*CN
z%{14IXaKEfK-<xY+tG0yXkxw5Bj{FqjXpPw6~6yxV#m~UM+leE3@Wa_GN2wEuozu%
zB`(1%x`&;(68GYbIE?P~B-Z04bbOk3*)!3A)AOL`FJx)>K#Lu?4V_>Y8b}vfnb*;+
zc@xd}z1aV8^cc3%pGPZNN`0%b92a5+Z^B1$I&jSKY}iYq3O_`zzeI`<&R_;7km`pt
z^<0h1(M(>zEOz6197O|P$Yd_C2%YC{tigwI89sw1cC?E68{y}4P^It-T7f^2xx!^M
z<4PWK@6zbmScGfwF0?Wo=$?1Q`+evF2a)p^K0$vszQ7GQn|IycfwmO&cf!qdJcirR
zg-)Xrj-aI;LrXf2{!~w(<EGF6FQL!R;2ks5O7xH}NB6o7oo5I7+|y`+FXw2u_wPoJ
zBGnGZ(F{h=fX+w9(Frd^ui|BP{2a7$Rp_`|(ZE)q6<UifoJF^|4c(gDP8#lQH~P!h
zkM7-9=!8F@6OJL(3scD2AxWBU+3je+tI_9M(S@Hv1K)+7l^4;9?TfyJ%v&A$X}A{y
v@y2Ipq$g|kpC~$%&&}Lcn9mfKB=Q}lOB4Cu=e<;z|E}`wME=P9vjzVFWy#B$

diff --git a/netbox_slm/locale/de/LC_MESSAGES/django.po b/netbox_slm/locale/de/LC_MESSAGES/django.po
index d331a20..063d15c 100644
--- a/netbox_slm/locale/de/LC_MESSAGES/django.po
+++ b/netbox_slm/locale/de/LC_MESSAGES/django.po
@@ -408,3 +408,12 @@ msgstr "Lizenzen"
 
 msgid "Licence Management NetBox Plugin."
 msgstr "NetBox-Plugin zur Lizenzverwaltung."
+
+msgid "Can manage license email notifications"
+msgstr "Kann E-Mail-Benachrichtigungen für Lizenzen verwalten"
+
+msgid "You do not have permission to change email notifications."
+msgstr "Sie haben keine Berechtigung, E-Mail-Benachrichtigungen zu ändern."
+
+msgid "Only administrators or explicitly authorized users can change this setting."
+msgstr "Nur Administratoren oder ausdrücklich berechtigte Benutzer können diese Einstellung ändern."
diff --git a/netbox_slm/migrations/0014_softwarelicense_email_notification_permission.py b/netbox_slm/migrations/0014_softwarelicense_email_notification_permission.py
new file mode 100644
index 0000000..c2b8a1e
--- /dev/null
+++ b/netbox_slm/migrations/0014_softwarelicense_email_notification_permission.py
@@ -0,0 +1,23 @@
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("netbox_slm", "0013_license_expiration_notifications"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="softwarelicense",
+            options={
+                "permissions": [
+                    (
+                        "manage_softwarelicense_email_notifications",
+                        "Can manage license email notifications",
+                    )
+                ],
+                "verbose_name": "software license",
+                "verbose_name_plural": "software licenses",
+            },
+        ),
+    ]
diff --git a/netbox_slm/models.py b/netbox_slm/models.py
index 5d1b2b0..c98ba00 100644
--- a/netbox_slm/models.py
+++ b/netbox_slm/models.py
@@ -267,6 +267,9 @@ class SoftwareLicense(NetBoxModel):
     class Meta:
         verbose_name = _("software license")
         verbose_name_plural = _("software licenses")
+        permissions = [
+            ("manage_softwarelicense_email_notifications", _("Can manage license email notifications")),
+        ]
 
     def __str__(self):
         return self.name
diff --git a/netbox_slm/views/software_license.py b/netbox_slm/views/software_license.py
index 4eb3716..e5c524b 100644
--- a/netbox_slm/views/software_license.py
+++ b/netbox_slm/views/software_license.py
@@ -1,9 +1,34 @@
 from netbox.views import generic
+from django.utils.translation import gettext_lazy as _
 from netbox_slm import filtersets, forms, tables
 from netbox_slm.models import SoftwareLicense
 from utilities.views import register_model_view
 
 
+class EmailNotificationPermissionMixin:
+    """Prevent users without the dedicated permission from changing SMTP delivery."""
+
+    email_permission = "netbox_slm.manage_softwarelicense_email_notifications"
+
+    def dispatch(self, request, *args, **kwargs):
+        form_attribute = "model_form" if hasattr(self, "model_form") else "form"
+        base_form = getattr(self, form_attribute)
+        can_manage_email = request.user.has_perm(self.email_permission)
+
+        class PermissionAwareForm(base_form):
+            def __init__(self, *form_args, **form_kwargs):
+                super().__init__(*form_args, **form_kwargs)
+                if not can_manage_email and "email_notifications" in self.fields:
+                    field = self.fields["email_notifications"]
+                    field.disabled = True
+                    field.help_text = _(
+                        "Only administrators or explicitly authorized users can change this setting."
+                    )
+
+        setattr(self, form_attribute, PermissionAwareForm)
+        return super().dispatch(request, *args, **kwargs)
+
+
 @register_model_view(SoftwareLicense, "list", path="", detail=False)
 class SoftwareLicenseListView(generic.ObjectListView):
     queryset = SoftwareLicense.objects.all()
@@ -19,7 +44,7 @@ class SoftwareLicenseView(generic.ObjectView):
 
 @register_model_view(SoftwareLicense, "add", detail=False)
 @register_model_view(SoftwareLicense, "edit")
-class SoftwareLicenseEditView(generic.ObjectEditView):
+class SoftwareLicenseEditView(EmailNotificationPermissionMixin, generic.ObjectEditView):
     queryset = SoftwareLicense.objects.all()
     form = forms.SoftwareLicenseForm
 
@@ -30,13 +55,13 @@ class SoftwareLicenseDeleteView(generic.ObjectDeleteView):
 
 
 @register_model_view(SoftwareLicense, "bulk_import", detail=False)
-class SoftwareLicenseBulkImportView(generic.BulkImportView):
+class SoftwareLicenseBulkImportView(EmailNotificationPermissionMixin, generic.BulkImportView):
     queryset = SoftwareLicense.objects.all()
     model_form = forms.SoftwareLicenseBulkImportForm
 
 
 @register_model_view(SoftwareLicense, "bulk_edit", path="edit", detail=False)
-class SoftwareLicenseBulkEditView(generic.BulkEditView):
+class SoftwareLicenseBulkEditView(EmailNotificationPermissionMixin, generic.BulkEditView):
     queryset = SoftwareLicense.objects.all()
     filterset = filtersets.SoftwareLicenseFilterSet
     table = tables.SoftwareLicenseTable