Opened 3 years ago

Last modified 3 years ago

#25656 assigned Bug

Recent Actions admin section contains link to edit form even when user does not have edit permission

Reported by: Anton Baklanov Owned by: Anton Baklanov
Component: contrib.admin Version: master
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

Steps to reproduce:

  • Login to admin with user that has add-only permission to certain model
  • Create an instance of this model
  • See that there is new logline within "Recent Actions" which contains link to edit form and results in 403 Forbidden.

This is something similar to what has been spotted by Tim Graham during https://github.com/django/django/pull/5244 review so perhaps it will be handy to fix it after PR 5244 is merged so one can extend test_no_forbidden_links_visible test with checks for this ticket.

Change History (2)

comment:1 Changed 3 years ago by Anton Baklanov

Owner: changed from nobody to Anton Baklanov
Status: newassigned

comment:2 Changed 3 years ago by Tim Graham

Triage Stage: UnreviewedAccepted

A bit similar to #2856 in case discussion on that ticket helps.

Note: See TracTickets for help on using tickets.
Back to Top