Ticket #15261: django-allow-superuser-filters-1.2.Xbackport.diff

django/contrib/admin/views/main.py

@@ -42 +42 @@
         self.list_per_page = list_per_page
         self.list_editable = list_editable
         self.model_admin = model_admin
+        self.allow_all_lookups = request.user.is_superuser
 
         # Get search parameters from the query string.
         try:
@@ -190 +191 @@
                     value = True
                 lookup_params[key] = value
 
-            if not self.model_admin.lookup_allowed(key, value):
+            if not (self.allow_all_lookups or self.model_admin.lookup_allowed(key, value)):
                 raise SuspiciousOperation(
                     "Filtering by %s not allowed" % key
                 )

tests/regressiontests/admin_changelist/tests.py

@@ -121 +121 @@
 
 class MockRequest(object):
     GET = {}
+    def __init__(self):
+        from django.contrib.auth.models import User
+        self.user = User(is_staff=True, is_superuser=False)

tests/regressiontests/admin_views/tests.py

@@ -343 +343 @@
             self.assertContains(response, '%Y-%m-%d %H:%M:%S')
         finally:
             deactivate()
-
-
-    def test_disallowed_filtering(self):
-        self.assertRaises(SuspiciousOperation,
-            self.client.get, "/test_admin/admin/admin_views/album/?owner__email__startswith=fuzzy"
-        )
-
-        try:
-            self.client.get("/test_admin/admin/admin_views/person/?age__gt=30")
-        except SuspiciousOperation:
-            self.fail("Filters should be allowed if they involve a local field without the need to whitelist them in list_filter or date_hierarchy.")
-
+    
+    def test_allowed_filtering(self):
         e1 = Employee.objects.create(name='Anonymous', gender=1, age=22, alive=True, code='123')
         e2 = Employee.objects.create(name='Visitor', gender=2, age=19, alive=True, code='124')
         WorkHour.objects.create(datum=datetime.datetime.now(), employee=e1)
@@ -365 +355 @@
         response = self.client.get("/test_admin/admin/admin_views/workhour/?employee__person_ptr__exact=%d" % e1.pk)
         self.assertEqual(response.status_code, 200)
 
-    def test_allowed_filtering_15103(self):
-        """
-        Regressions test for ticket 15103 - filtering on fields defined in a
-        ForeignKey 'limit_choices_to' should be allowed, otherwise raw_id_fields
-        can break.
-        """
-        try:
-            self.client.get("/test_admin/admin/admin_views/inquisition/?leader__name=Palin&leader__age=27")
-        except SuspiciousOperation:
-            self.fail("Filters should be allowed if they are defined on a ForeignKey pointing to this model")
-
 class AdminJavaScriptTest(AdminViewBasicTest):
     def testSingleWidgetFirsFieldFocus(self):
         """
@@ -493 +472 @@
         delete_user = User.objects.get(username='deleteuser')
         delete_user.user_permissions.add(get_perm(Article,
             opts.get_delete_permission()))
+        
+        # User who can change Inquisitions (for test_allowed_filtering_15103)
+        change_user = User.objects.get(username='changeuser')
+        change_user.user_permissions.add(get_perm(Inquisition,
+            Inquisition._meta.get_change_permission()))
 
         delete_user.user_permissions.add(get_perm(Section,
             Section._meta.get_delete_permission()))
@@ -791 +775 @@
         response = self.client.get('/test_admin/admin/secure-view/')
         self.assertContains(response, 'id="login-form"')
 
+    def test_disallowed_filtering(self):
+        """
+        Ensure cross-model querystring lookups are disallowed for non-superusers.
+        """
+        self.client.login(username='changeuser', password='secret')
+        self.assertRaises(SuspiciousOperation,
+            self.client.get, "/test_admin/admin/admin_views/article/?section__name__startswith=fuzzy"
+        )
+
+        try:
+            self.client.get("/test_admin/admin/admin_views/article/?title__startswith=fuzzy")
+        except SuspiciousOperation:
+            self.fail("Filters should be allowed if they involve a local field without the need to whitelist them in list_filter or date_hierarchy.")
+        
+        self.client.login(username='super', password='secret')
+        try:
+            self.client.get("/test_admin/admin/admin_views/article/?section__name__startswith=fuzzy")
+        except SuspiciousOperation:
+            self.fail("Filters should be allowed for superusers.")
+
+    def test_allowed_filtering_15103(self):
+        """
+        Regressions test for ticket 15103 - filtering on fields defined in a
+        ForeignKey 'limit_choices_to' should be allowed, otherwise raw_id_fields
+        can break.
+        """
+        self.client.login(username='changeuser', password='secret')
+        try:
+            self.client.get("/test_admin/admin/admin_views/inquisition/?leader__name=Palin&leader__age=27")
+        except SuspiciousOperation:
+            self.fail("Filters should be allowed if they are defined on a ForeignKey pointing to this model")
+
 
 class AdminViewDeletedObjectsTest(TestCase):
     fixtures = ['admin-views-users.xml', 'deleted-objects.xml']