#28517: admin does not check if a model has default_permissions before raising
PermissionDenied
-----------------------------------------+------------------------
Reporter: Paulo | Owner: nobody
Type: Uncategorized | Status: new
Component: Uncategorized | Version: 1.11
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------
Hello,
Given the following models:
{{{
class Product(models.Model):
name = models.CharField(max_length=200)
def __str__(self):
return self.name
class ProductMeta(models.Model):
name = models.CharField(max_length=200)
product = models.ForeignKey(to=Product, on_delete=models.CASCADE)
class Meta:
default_permissions = ()
def __str__(self):
return self.name
class InternalProduct(Product):
class Meta:
proxy = True
default_permissions = ()
}}}
Assumptions:
* All models are registered with the admin.
* Current user is staff with all permissions (non-superuser).
Create Product instances:
* product_a = Product.objects.create(name='product a')
* product_b = Product.objects.create(name='product b')
Create ProductMeta instances:
* ProductMeta.objects.create(name='product a metadata', product=product_a)
* ProductMeta.objects.create(name='product b metadata', product=product_b)
The following two scenarios will fail:
* User tries to delete a Product from admin.
* User tries to delete an InternalProduct from admin.
The first scenario fails because the admin checks if user has delete
permission on the collected objects without checking if the delete
permission is present on the default_permissions for the collected models.
The second scenario fails because the has_x_permission checks assume
add/change/delete are present in default_permissions.
--
Ticket URL: <https://code.djangoproject.com/ticket/28517>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.181e7e8fa43be2bbf1d641b4b598a484%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
