Opened 10 years ago

Closed 10 years ago

#23839 closed Bug (duplicate)

Regression in the admin's handling of querystring allowed fields

Reported by: Julien Phalip Owned by: Simon Charette
Component: contrib.admin Version: 1.6
Severity: Release blocker Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: yes
Easy pickings: no UI/UX: no

Description

Recent security patches have introduced a number of regressions. Most of those regressions have already been addressed in #23329 and #23604. However, there is still at least one remaining regression, where a model with a FK cannot be referenced by its primary key. This issue happens in particular when the said model is not registered as an inline, which occurs in a third-party like FeinCMS.

FeinCMS implemented a work-around: ​https://github.com/feincms/feincms/commit/30e93f33ffb17d9a3544c9bbc83c8bfa57b24a60

Impending pull request loosens the check by always allowing the primary key to be referenced in the querystring.

Change History (4)

comment:2 by Collin Anderson, 10 years ago

Triage Stage: Accepted → Ready for checkin

comment:3 by Tim Graham, 10 years ago

Patch needs improvement: set
Triage Stage: Ready for checkin → Accepted

Bumping off RFC per Simon's comment on the PR: "Please don't merge yet, I'd like to discuss the whole subject of to_field_allowed regressions on the developers mailing list first."

comment:4 by Simon Charette, 10 years ago

Resolution: → duplicate
Status: new → closed

After further analysis this should be considered a duplicate of #23754.

Note: See TracTickets for help on using tickets.
Back to Top