Recent Actions admin section contains link to edit form even when user does not have edit permission
Steps to reproduce:
- Login to admin with user that has add-only permission to certain model
- Create an instance of this model
- See that there is new logline within "Recent Actions" which contains link to edit form and results in 403 Forbidden.
This is something similar to what has been spotted by Tim Graham during https://github.com/django/django/pull/5244 review so perhaps it will be handy to fix it after PR 5244 is merged so one can extend test_no_forbidden_links_visible test with checks for this ticket.
Change History
(12)
| Owner: |
changed from nobody to Anton Baklanov
|
| Status: |
new → assigned
|
| Triage Stage: |
Unreviewed → Accepted
|
| Owner: |
Anton Baklanov removed
|
| Status: |
assigned → new
|
| Owner: |
set to AP Jama
|
| Status: |
new → assigned
|
| Patch needs improvement: |
set
|
| Owner: |
changed from AP Jama to Artyom Kotovskiy
|
| Patch needs improvement: |
unset
|
| Patch needs improvement: |
set
|
| Patch needs improvement: |
unset
|
| Triage Stage: |
Accepted → Ready for checkin
|
| Patch needs improvement: |
set
|
| Triage Stage: |
Ready for checkin → Accepted
|
A bit similar to #2856 in case discussion on that ticket helps.