Ticket #11191: 11191.2.diff

django/contrib/admin/options.py

@@ -6 +6 @@
 from django.contrib.admin import widgets
 from django.contrib.admin import helpers
 from django.contrib.admin.util import unquote, flatten_fieldsets, get_deleted_objects, model_ngettext, model_format_dict
-from django.core.exceptions import PermissionDenied
+from django.core.exceptions import PermissionDenied, ValidationError, ObjectDoesNotExist
 from django.db import models, transaction
 from django.db.models.fields import BLANK_CHOICE_DASH
 from django.http import Http404, HttpResponse, HttpResponseRedirect
@@ -347 +347 @@
         defaults.update(kwargs)
         return modelform_factory(self.model, **defaults)
 
+    def get_object(self, request, object_id):
+        """
+        Returns an instance matching the primary key provided.
+
+        The most two errors which may be raised by this method are
+        ``ValidationError`` (if the object_id was of an invalid type) or
+        ``model.DoesNotExist`` (if no match was found).
+        """
+        queryset = self.queryset(request)
+        object_id = queryset.model._meta.pk.to_python(object_id)
+        return queryset.get(pk=object_id)
+
     def get_changelist_form(self, request, **kwargs):
         """
         Returns a Form class for use in the Formset on the changelist page.
@@ -789 +801 @@
         opts = model._meta
 
         try:
-            obj = self.queryset(request).get(pk=unquote(object_id))
-        except model.DoesNotExist:
+            obj = self.get_object(request, unquote(object_id))
+        except (ObjectDoesNotExist, ValidationError):
             # Don't raise Http404 just yet, because we haven't checked
             # permissions yet. We don't want an unauthenticated user to be able
             # to determine whether a given object exists.
@@ -989 +1001 @@
         app_label = opts.app_label
 
         try:
-            obj = self.queryset(request).get(pk=unquote(object_id))
-        except self.model.DoesNotExist:
+            obj = self.get_object(request, unquote(object_id))
+        except (ObjectDoesNotExist, ValidationError):
             # Don't raise Http404 just yet, because we haven't checked
             # permissions yet. We don't want an unauthenticated user to be able
             # to determine whether a given object exists.

tests/regressiontests/admin_views/tests.py

@@ -63 +63 @@
 
     def testBasicEditGet(self):
         """
-        A smoke test to ensureGET on the change_view works.
+        A smoke test to ensure GET on the change_view works.
         """
         response = self.client.get('/test_admin/%s/admin_views/section/1/' % self.urlbit)
         self.failUnlessEqual(response.status_code, 200)
 
+    def testBasicEditGetStringPK(self):
+        """
+        A smoke test to ensure GET on the change_view works (returns an HTTP
+        404 error, see #11191) when passing a string as the PK argument for a
+        model with an integer PK field.
+        """
+        response = self.client.get('/test_admin/%s/admin_views/section/abc/' % self.urlbit)
+        self.failUnlessEqual(response.status_code, 404)
+
     def testBasicAddPost(self):
         """
         A smoke test to ensure POST on add_view works.