secured the plugin a bit for 0.1.1

proxmox_power_button/views.py

@@ -61,7 +61,12 @@ class VMPowerActionView(PermissionRequiredMixin, View):
         return redirect("virtualization:virtualmachine", pk=pk)
 
     def post(self, request, pk, action):
-        vm = get_object_or_404(VirtualMachine, pk=pk)
+        # Scope the lookup through NetBox's object-permission system: a user
+        # whose change_virtualmachine permission is constraint-scoped gets a
+        # 404 on VMs outside their scope, exactly like core NetBox views.
+        vm = get_object_or_404(
+            VirtualMachine.objects.restrict(request.user, "change"), pk=pk
+        )
 
         if action not in VALID_ACTIONS:
             logger.error("user=%s vm=%s: unknown power action '%s'", request.user, vm.name, action)
@@ -72,7 +77,13 @@ class VMPowerActionView(PermissionRequiredMixin, View):
             result = power_action(vm, action)
         except ProxmoxError as exc:
             logger.error("user=%s vm=%s: %s failed: %s", request.user, vm.name, action, exc)
-            messages.error(request, f"Proxmox action failed: {exc}")
+            # Don't echo raw Proxmox/network errors to the browser — they can
+            # leak internal hostnames, URLs, and response bodies. Full detail
+            # is in the log line above.
+            messages.error(
+                request,
+                f"Proxmox {action} failed for {vm.name} — see the NetBox log for details.",
+            )
             return redirect("virtualization:virtualmachine", pk=vm.pk)
 
         if action == "start":