Opened 90 minutes ago
#37264 assigned Bug
Admin popup add view crashes on malformed `_source_model` value
| Reported by: | Adam Johnson | Owned by: | Adam Johnson |
|---|---|---|---|
| Component: | contrib.admin | Version: | 6.1 |
| Severity: | Normal | Keywords: | |
| Cc: | Triage Stage: | Unreviewed | |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
Regression in b1ffa9a9d78b0c2c5ad6ed5a1d84e380d5cfd010 (Fixed #13883 -- Rendered named choice groups with <optgroup> in FilteredSelectMultiple)o.
ModelAdmin.response_add() now reads a _source_model POST parameter and unpacks it with:
app_label, model_name = source_model_name.split(".", 1)
…before any error handling.
A value without an app_label.model_name dot separator raises ValueError: not enough values to unpack (expected 2, got 1), returning an HTTP 500 after the object has already been saved.
Any user with add permission can trigger it via a crafted POST or third-party JavaScript setting a bad value.
In Django 6.0, unknown POST keys were ignored and popup add always succeeded.
Minimal reproduction: as a user with add permission, POST to any admin add view with an otherwise valid form plus _popup=1&_source_model=foo (no dot).
The object is saved, then the response is a 500.