id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37264	Admin popup add view crashes on malformed `_source_model` value	Adam Johnson	Adam Johnson	"Regression in b1ffa9a9d78b0c2c5ad6ed5a1d84e380d5cfd010 (Fixed #13883 -- Rendered named choice groups with `<optgroup>` in FilteredSelectMultiple)o.

`ModelAdmin.response_add()` now reads a `_source_model` POST parameter and unpacks it with:

{{{#!python
app_label, model_name = source_model_name.split(""."", 1)
}}}

…before any error handling.
A value without an `app_label.model_name` dot separator raises `ValueError: not enough values to unpack (expected 2, got 1)`, returning an HTTP 500 '''after the object has already been saved'''.
Any user with add permission can trigger it via a crafted POST or third-party JavaScript setting a bad value.
In Django 6.0, unknown POST keys were ignored and popup add always succeeded.

'''Minimal reproduction''': as a user with add permission, POST to any admin add view with an otherwise valid form plus `_popup=1&_source_model=foo` (no dot).
The object is saved, then the response is a 500."	Cleanup/optimization	assigned	contrib.admin	6.1	Normal				Accepted	1	0	0	0	0	0