id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
22828	Model admins should return copies of its attributes	Vlastimil Zíma	Karol Alvarado	"I found out there is hidden problem in `ModelAdmin`s. Getters returns directly attributes and not their copies. This has a hidden danger in cases when you override the getters. You can easily change the configuration of the model admin.

Example:
{{{
#!python
from django.contrib.admin.options import BaseModelAdmin
class MyAdmin(BaseModelAdmin):
    readonly_fields = ['foo', ]

admin = MyAdmin()
rf = admin.get_readonly_fields(None)
# For example, but it can very easily happen in the method override.
rf.append('bar')
MyAdmin.readonly_fields #>>> ['foo', 'bar']
}}}

=== Affected attributes ===
 * fieldsets
 * fileds
 * ordering
 * readonly_fields
 * prepopulated_fields
 * list_display
 * list_display_links
 * list_filter
 * search_fields


Django should return copies in getters of these attributes to avoid unwanted changes of the `ModelAdmin` at runtime."	Bug	closed	contrib.admin	dev	Normal	fixed		Tim Graham Karol Alvarado	Ready for checkin	1	0	0	0	0	0