#23329: Regression in security patch for querystring manipulation in admin
-------------------------------+--------------------
Reporter: Markush2010 | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 1.5
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
At least on 1.5.9 the following modified Test failed:
Explanation: the model "Recommendation" inherits from "Title".
"Recommendation" has a ModelAdmin registerd, "Title" does not. Due to the
restrictiveness of the new ``to_field_allowed`` function, one cannot open
the popup for "Recommendation" anymore.
{{{#!diff
diff --git a/tests/regressiontests/admin_views/tests.py
b/tests/regressiontests/admin_views/tests.py
index e7efca2..08f90d8 100644
--- a/tests/regressiontests/admin_views/tests.py
+++ b/tests/regressiontests/admin_views/tests.py
@@ -567,6 +567,11 @@ class AdminViewBasicTest(TestCase):
with self.assertRaises(DisallowedModelAdminToField):
response =
self.client.get("/test_admin/admin/admin_views/section/", {TO_FIELD_VAR:
'name'})
+ # Specifying a field that is not refered by any other model
directly registered
+ # to this admin site but registered through inheritance
+ response =
self.client.get("/test_admin/admin/admin_views/recommendation/",
{TO_FIELD_VAR: 'id'})
+ self.assertEqual(response.status_code, 200)
+
# Specifying a field referenced by another model should be
allowed.
response =
self.client.get("/test_admin/admin/admin_views/section/", {TO_FIELD_VAR:
'id'})
self.assertEqual(response.status_code, 200)
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/23329>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/054.e6d6e34b66731220a709faddcdd5e973%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
