Fixes: #15924 - Prevent API payload from allowing tagged_vlans while interface mode is set to tagged-all

netbox/dcim/api/serializers_/device_components.py

@@ -1,3 +1,4 @@
+from django.utils.translation import gettext as _
 from django.contrib.contenttypes.models import ContentType
 from drf_spectacular.utils import extend_schema_field
 from rest_framework import serializers
@@ -236,8 +237,8 @@ class Meta:
 
     def validate(self, data):
 
-        # Validate many-to-many VLAN assignments
         if not self.nested:
+            # Validate many-to-many VLAN assignments
             device = self.instance.device if self.instance else data.get('device')
             for vlan in data.get('tagged_vlans', []):
                 if vlan.site not in [device.site, None]:
@@ -246,6 +247,13 @@ def validate(self, data):
                                         f"or it must be global."
                     })
 
+            # Validate that tagged-all payload does not include tagged_vlans
+            mode = data.get('mode') or getattr(self.instance, 'mode', None)
+            if mode == InterfaceModeChoices.MODE_TAGGED_ALL and data.get('tagged_vlans'):
+                raise serializers.ValidationError({
+                    'tagged_vlans': "Tagged-All interface mode must not include any tagged vlans"
+                })
+
         return super().validate(data)
 
 

netbox/dcim/models/device_components.py

@@ -914,6 +914,10 @@ def save(self, *args, **kwargs):
 
         super().save(*args, **kwargs)
 
+        # Clear any tagged vlans set when mode is tagged-all
+        if self.mode == InterfaceModeChoices.MODE_TAGGED_ALL and self.tagged_vlans.count():
+            self.tagged_vlans.set([])
+
     @property
     def _occupied(self):
         return super()._occupied or bool(self.wireless_link_id)