Bulk import update fails with "Select a valid choice" when the CSV includes a token's user or a journal entry's created_by #23653

NetBox Edition

NetBox Community

NetBox Version

v4.7.4

Python Version

3.12

Steps to Reproduce

1. As an admin, create user owner and a token belonging to owner (note its ID, say 1, and owner's ID, say 2).
2. Create user editor with an object permission granting add, change and view on Token plus users.grant_token, and no permission on User.
3. Log in as editor and go to Tokens > Import.
4. Submit this CSV:

   id,user,description
   1,2,updated
   

The same happens for journal entries: give editor add, change and view on Journal Entry plus view on the assigned object, then import id,created_by,comments with an existing entry's ID and its author's user ID.

Expected Behavior

The token's description is updated. The user column is ignored on update, since the owner can't be reassigned (#22307).

Observed Behavior

The import is rejected with Record 1 user: Select a valid choice. That choice is not one of the available choices. and nothing is updated. The journal entry import fails the same way on created_by. Both imports succeed once editor is also granted view on User, and both succeed if the column is left out of the CSV.

This bites anyone re-importing an export, which includes the column.

Suspected Cause

TokenImportForm (users/forms/bulk_import.py:58) and JournalEntryImportForm (extras/forms/bulk_import.py:440) mark the field disabled when updating. A disabled field still validates the instance's current value against its queryset, and BulkImportView runs restrict_form_fields() on the form first (netbox/views/generic/bulk_views.py:645), which limits the User queryset to users the importer can view. If the importer can't view the owner, the current value fails validation.

This is the import-side twin of #23558, which hit the same thing on the token edit form.

Proposed Fix

No response

Volunteer

• I volunteer to submit a fix for this bug if it is accepted