#28517: admin does not check if a model has default_permissions before raising
PermissionDenied
-------------------------------------+-------------------------------------
Reporter: Paulo | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: contrib.admin | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Paulo):
Because the admin allows us to override the has_x_permission methods, I
think the main problem is the delete check buried in get_deleted_objects.
The main use-case I see is to support creating proxy models that need to
override parts of the admin for the base model but do not need their own
permissions.
This is achievable by setting default_permissions to empty on the proxy
model and pointing all has_x_permission methods to the same logic from the
base model.
I've attached a patch (untested) which I think fixes this. I can push a PR
later today with tests.
--
Ticket URL: <https://code.djangoproject.com/ticket/28517#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.eceac214afde42267dcdacf9afbed181%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
