Opened 4 years ago

Closed 4 years ago

Last modified 3 years ago

#14999 closed (fixed)

Valid lookups are rejected after r15031

Reported by: medhat Owned by: nobody
Component: contrib.admin Version: 1.3-beta
Severity: Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

The description of the fix for the recently found security issue in the admin interface states the following: "To remedy this, django.contrib.admin will now validate that querystring lookup arguments either specify only fields on the model being viewed, or cross relations which have been explicitly whitelisted by the application developer using the pre-existing mechanism mentioned above."

To me this means that a querystring lookup argument for a field that is on the model does not need to be whitelisted. But it does not seem to be working this way, it seems that *any* field in the querystring lookup arguments need to be whitelisted, this else will apply to all fields, not just cross relations.

I use this querystring building trick to filter on a FloatField, to filter either by field__lt=0 or field__gt=0. Adding that field to list_filters just lists all the values this field has which is not very useful.

Attachments (1)

14999-trunk.diff (3.3 KB) - added by ramiro 4 years ago.
Tentative fix for this issue.

Download all attachments as: .zip

Change History (8)

comment:1 Changed 4 years ago by medhat

  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Summary changed from Valid lookups are regected after r15031 to Valid lookups are rejected after r15031

comment:2 Changed 4 years ago by russellm

  • Triage Stage changed from Unreviewed to Accepted

This appears to be an oversight in the security patch. This is a 1.3 blocker.

Changed 4 years ago by ramiro

Tentative fix for this issue.

comment:3 Changed 4 years ago by ramiro

  • Has patch set

comment:4 Changed 4 years ago by russellm

  • Resolution set to fixed
  • Status changed from new to closed

(In [15139]) Fixed #14999 -- Ensure that filters on local fields are allowed, and aren't caught as a security problem. Thanks to medhat for the report.

comment:5 Changed 4 years ago by russellm

(In [15140]) [1.2.X] Fixed #14999 -- Ensure that filters on local fields are allowed, and aren't caught as a security problem. Thanks to medhat for the report.

Backport of r15139 from trunk.

comment:6 Changed 4 years ago by ramiro

(In [15176]) [1.1.X] Fixed #14999 -- Ensure that filters on local fields are allowed, and aren't caught as a security problem. Thanks to medhat for the report.

Backport of r15139 from trunk.

comment:7 Changed 3 years ago by jacob

  • milestone 1.3 deleted

Milestone 1.3 deleted

Note: See TracTickets for help on using tickets.
Back to Top