Ticket #13709: admin_action_permission_check.patch

django/django/contrib/admin/actions.py

@@ -30 +30 @@
     opts = modeladmin.model._meta
     app_label = opts.app_label
 
-    # Check that the user has delete permission for the actual model
-    if not modeladmin.has_delete_permission(request):
-        raise PermissionDenied
-
     # Populate deletable_objects, a data structure of all related objects that
     # will also be deleted.
 
@@ -87 +83 @@
     ], context, context_instance=template.RequestContext(request))
 
 delete_selected.short_description = ugettext_lazy("Delete selected %(verbose_name_plural)s")
+delete_selected.has_permission = lambda admin, request: admin.has_delete_permission(request)

django/django/contrib/admin/options.py

@@ -455 +455 @@
                 continue
             actions.extend([self.get_action(action) for action in class_actions])
 
-        # get_action might have returned None, so filter any of those out.
-        actions = filter(None, actions)
+        # get_action might have returned None, so filter any of those out and
+        # ensure that the action is usable in the current context.
+        actions = [a for a in actions if a and (not hasattr(a[0], 'has_permission') or a[0].has_permission(self, request))]
 
         # Convert the actions into a SortedDict keyed by name
         # and sorted by description.