Ticket #13325: check_perms_related_widget.diff

django/contrib/admin/options.py

@@ -109 +109 @@
             # rendered output. formfield can be None if it came from a
             # OneToOneField with parent_link=True or a M2M intermediary.
             if formfield and db_field.name not in self.raw_id_fields:
-                formfield.widget = widgets.RelatedFieldWidgetWrapper(formfield.widget, db_field.rel, self.admin_site)
+                formfield.widget = widgets.RelatedFieldWidgetWrapper(formfield.widget, db_field.rel, self.admin_site, request)
 
             return formfield
 

django/contrib/admin/widgets.py

@@ -205 +205 @@
     This class is a wrapper to a given widget to add the add icon for the
     admin interface.
     """
-    def __init__(self, widget, rel, admin_site):
+    def __init__(self, widget, rel, admin_site, request):
         self.is_hidden = widget.is_hidden
         self.needs_multipart_form = widget.needs_multipart_form
         self.attrs = widget.attrs
@@ -214 +214 @@
         self.rel = rel
         # so we can check if the related object is registered with this AdminSite
         self.admin_site = admin_site
+        self.request = request
 
     def __deepcopy__(self, memo):
         obj = copy.copy(self)
@@ -236 +237 @@
             related_url = '%s%s/%s/add/' % info
         self.widget.choices = self.choices
         output = [self.widget.render(name, value, *args, **kwargs)]
-        if rel_to in self.admin_site._registry: # If the related object has an admin interface:
+        if rel_to in self.admin_site._registry and self.admin_site._registry[rel_to].has_add_permission(self.request): # If the related object has an admin interface:
             # TODO: "id_" is hard-coded here. This should instead use the correct
             # API to determine the ID dynamically.
             output.append(u'<a href="%s" class="add-another" id="add_id_%s" onclick="return showAddAnotherPopup(this);"> ' % \