Repository: nautobot/nautobot

Issue:
Rack elevation renderings not shown when X-Frame-Options is set to DENY
<!--
    NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED.

    This form is only for reporting reproducible bugs. If you need assistance
    with Nautobot installation, or if you have a general question, please start a
    discussion instead: https://github.com/nautobot/nautobot/discussions

    Please describe the environment in which you are running Nautobot. Be sure
    that you are running an unmodified instance of the latest stable release
    before submitting a bug report, and that any plugins have been disabled.
-->
### Environment
* Python version: 3.6.8
* Nautobot version: 1.1.3

<!--
    Describe in detail the exact steps that someone else can take to reproduce
    this bug using the current stable release of Nautobot. Begin with the
    creation of any necessary database objects and call out every operation
    being performed explicitly. If reporting a bug in the REST API, be sure to
    reconstruct the raw HTTP request(s) being made: Don't rely on a client
    library such as pynautobot.
-->
Checking button to show images does not do anything.
![image](https://user-images.githubusercontent.com/26114847/134506213-6d195923-9f07-4261-9118-41127837180a.png)
![image](https://user-images.githubusercontent.com/26114847/134506238-295bf5c7-e9ad-462f-b48d-b7c1d4fe4fb4.png)
To be able to see organization of devices in rack I have to click on `Save SVG` on both front and rear.
Note: `Save SVG` does not clearly describe what is shown - it is SVG with interactable overlay. It does not trigger "save file" dialog.
### Steps to Reproduce
1. open `/dcim/racks/:uuid`
2. click `Show Images` button
3. expect images shown

<!-- What did you expect to happen? -->
### Expected Behavior
No change at all

<!-- What happened instead? -->
### Observed Behavior
Images shown

Note:
Not sure if the button ever worked, in old Netbox 2.5.13 there is no button and the images are shown directly:
![image](https://user-images.githubusercontent.com/26114847/134506800-878e848a-232e-400b-bf15-933b5f10ef6d.png)



Discussion:
The "Show Images" toggle is supposed to switch between whether device-type images are shown in the rack elevation or whether the simpler colored-boxes rendering is shown  - a rack elevation image should be visible regardless in either case. Can you check your browser console to see if any errors are being reported?
Glen, thanks for the quick answer. I found I cannot see any images due to `X-FRAME-OPTIONS` set to `DENY` for security reasons. I set it to `SAMEORIGIN` for now and discuss with InfoSec the implications.

Adding any image to the corresponding device type correctly shows the images. Thanks for your help

Note: Setting the value to anything but `DENY`will cause security warning on Nautobot startup:
![image](https://user-images.githubusercontent.com/26114847/134520207-a43aef78-f11d-42be-b96a-a35b363220cd.png)
 
 @glennmatthews Do you want to reopen this to continue the discussion? I don't like warnings even though it is harmless :)
 Is there another way to have it implemented with `X-FRAME-OPTIONS=DENY` and the rack elevation showing?
A few options offhand:

- Per https://docs.djangoproject.com/en/3.2/ref/clickjacking/, it looks like we could possibly add the `@xframe_options_sameorigin` specifically to the `nautobot.dcim.api.views.RackViewSet.elevation` view function so that it sets SAMEORIGIN even if we're set to DENY globally - this might be the best option
- [Silence the warning](https://docs.djangoproject.com/en/3.2/ref/settings/#std:setting-SILENCED_SYSTEM_CHECKS) by setting `SILENCED_SYSTEM_CHECKS=["security.W019"] - not always a desirable option, obviously, but I present it for sake of completeness :-)

Reopening this for visibility to the team. :-)
Based on some initial testing, using the `@xframe_options_sameorigin` decorator on the elevation view, in combination with setting the global default to `DENY`, appears to address this issue. I should have a PR open soon.

Resolving patch:
diff --git a/nautobot/core/settings.py b/nautobot/core/settings.py
--- a/nautobot/core/settings.py
+++ b/nautobot/core/settings.py
@@ -381,7 +381,7 @@
 WSGI_APPLICATION = "nautobot.core.wsgi.application"
 SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
 USE_X_FORWARDED_HOST = True
-X_FRAME_OPTIONS = "SAMEORIGIN"
+X_FRAME_OPTIONS = "DENY"
 
 # Static files (CSS, JavaScript, Images)
 STATIC_ROOT = os.path.join(NAUTOBOT_ROOT, "static")
diff --git a/nautobot/dcim/api/views.py b/nautobot/dcim/api/views.py
--- a/nautobot/dcim/api/views.py
+++ b/nautobot/dcim/api/views.py
@@ -5,6 +5,7 @@
 from django.db.models import F
 from django.http import HttpResponseForbidden, HttpResponse
 from django.shortcuts import get_object_or_404
+from django.views.decorators.clickjacking import xframe_options_sameorigin
 from drf_yasg import openapi
 from drf_yasg.openapi import Parameter
 from drf_yasg.utils import swagger_auto_schema
@@ -198,6 +199,7 @@ class RackViewSet(StatusViewSetMixin, CustomFieldModelViewSet):
         query_serializer=serializers.RackElevationDetailFilterSerializer,
     )
     @action(detail=True)
+    @xframe_options_sameorigin
     def elevation(self, request, pk=None):
         """
         Rack elevation representing the list of rack units. Also supports rendering the elevation as an SVG.


Test patch: