POST to delete protected fk relationship raises ProtectedError

[Zelvuska]

If model instance is not deletable in admin due to PROTECTED option in related model, doing a POST to delete this instance raises ProtectedError.

[Fyodor Ananiev]

Replying to Zelvuska:
I understand that it is an expected behaviour. models.PROTECT prohibits deletion of an object in general, and POST is one of these ways.

[Zelvuska]

Replying to tedmx:
Yes, I understand that and I agree. But I would expect that this ProtectedError would be caught and handled in the admin. But doing POST instead causes ServerError which is probably not expected.

[Tim Graham]

Is this the actions "delete selected" page as described in #21734? Did you skip the intermediate page that checks for protected items?

[Zelvuska]

Yes, it seems that #21734 might be related. We have stumbled upon this while writing tests for our application.

But you can trigger this when you just submit the intermediate page that states that you cannot delete protected item.

[Tim Graham]

The "delete" button shouldn't appear on the intermediate page, no?

[Tim Graham]

I guess we could try to prevent the issue in case the intermediate page is bypassed. Test attached.

[Fyodor Ananiev]

Zelvuska and Tim, thank you a lot for more insight. What should be a good response for POST request like that? Intermediate page, like in a test_protected from the same test case?

[Akshesh Doshi]

tedmx
I think an error message stating that protected objects cannot be deleted should be fine.

[Zelvuska]

tedmx
I think that the intermediate page is perfect. So in case someone tries to bypass it, just display it again.

[Akshesh Doshi]

PR: ​https://github.com/django/django/pull/6192

[Tim Graham <timograham@…>]

In 49ac10b:

Fixed #26235 -- Handled ProtectedError in a POST to admin's delete_view().