id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
20376	Inline permissions on self-related m2m field	Pantelis Petridis	nobody	"I have a model that relates to itself like this:


{{{
class Article(models.Model):
  ...
  related_articles = models.ManyToManyField('self', blank=True, null=True)
}}}


For presentation purposes I choose to display it as inline on the admin website:


{{{
class RelatedArticlesInline(admin.TabularInline):
  model = Article.related_articles.through
  fk_name = 'from_article'
  raw_id_fields = ('to_article',)

class ArticleAdmin(admin.ModelAdmin):
  ...
  inlines = (RelatedArticlesInline,)

admin.site.register(Article, ArticleAdmin)
}}}

'''The problem:''' Non-superuser staff accounts are not able to see the related articles inline, despite they have been assigned all Article permissions.

'''The reason:''' Obviously this is a permission bug in the inline. It appears the problem is lying in django.contrib.admin.options.InlineModelAdmin.has_change_permission(). In line 1556 (as of current master source) we do:


{{{
for field in opts.fields:
  if field.rel and field.rel.to != self.parent_model:
    opts = field.rel.to._meta
    break
}}}

Since both ForeignKey fields of the intermediate model point to the parent model (self-relation), the code fails to discover the appropriate permissions.

This is checked with Django 1.5."	Bug	closed	contrib.admin	1.5	Normal	needsinfo			Unreviewed	0	0	0	0	0	0