Ticket #6977: 6977.patch

django/contrib/auth/admin.py

@@ -28 +28 @@
     def add_view(self, request):
         # avoid a circular import. see #6718.
         from django.contrib.auth.forms import UserCreationForm
-        if not self.has_change_permission(request):
+        if not self.has_add_permission(request):
             raise PermissionDenied
+
         if request.method == 'POST':
             form = UserCreationForm(request.POST)
             if form.is_valid():
@@ -40 +41 @@
                     return HttpResponseRedirect(request.path)
                 else:
                     request.user.message_set.create(message=msg + ' ' + ugettext("You may edit it again below."))
-                    return HttpResponseRedirect('../%s/' % new_user.id)
+
+                    if self.has_change_permission(request, None):
+                        # redirect to change view
+                        post_url = '../%s/' % new_user.id
+                    else:
+                        # Object list will give 'Permission Denied', so go back to admin home
+                        post_url = '../../../'
+
+                    return HttpResponseRedirect(post_url)
         else:
             form = UserCreationForm()
         return render_to_response('admin/auth/user/add_form.html', {