id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
14999	Valid lookups are rejected after r15031	medhat	nobody	"The description of the fix for the recently found security issue in the admin interface states the following: ""To remedy this, django.contrib.admin will now validate that querystring lookup arguments either specify only fields on the model being viewed, or cross relations which have been explicitly whitelisted by the application developer using the pre-existing mechanism mentioned above.""

To me this means that a querystring lookup argument for a field that is on the model does not need to be whitelisted. But it does not seem to be working this way, it seems that *any* field in the querystring lookup arguments need to be whitelisted, [http://code.djangoproject.com/browser/django/trunk/django/contrib/admin/options.py#L241 this else] will apply to all fields, not just cross relations.

I use this querystring building trick to filter on a !FloatField, to filter either by {{{field__lt=0}}} or {{{field__gt=0}}}. Adding that field to list_filters just lists all the values this field has which is not very useful."		closed	contrib.admin	1.3-beta		fixed			Accepted	1	0	0	0	0	0