id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
16958	change_password admin view ignores ModelAdmin queryset(request) method	Marco Paolini	Wiktor	"change_password view in {{{django.contrib.auth.admin.UserAdmin}}} does not use
{{{self.queryset()}}} to retrieve the user instance to act on.

Let's assume a developer has subclassed UserAdmin overriding its queryset
method to hide certain users from admin web interface,
then he would be surprised to find out that someone with change_user
permission can still change password of these hidden users.

attached patch (applies to trunk) with test.
"	Bug	closed	contrib.auth	1.3	Normal	fixed	admin, auth		Ready for checkin	1	0	0	0	0	0