id summary reporter owner description type status component version severity resolution keywords cc stage has_patch needs_docs needs_tests needs_better_patch easy ui_ux 29487 "Admin ""read only"" doesn't check change permission for object specifically" Matthew Frazier Paulo "When determining which fields are read-only, `ModelAdmin._changeform_view` calls `ModelAdmin.has_change_permission(request)` without the object parameter - so, even if the user has read-only permission, only fields returned by `get_readonly_fields()` are included. However, subsequent calls to `has_change_permission` to build the form do use the object parameter - so, all fields are left out of the form, with the assumption that they are included in `get_readonly_fields()`. This leads to a traceback when rendering the template, since none of the fields are present in the form. (The traceback is included below.) Changing `has_change_permission(request)` to `has_change_permission(request, obj)` on [[https://github.com/django/django/blob/860903b261517442098bdf14e44f4fd4ae20aeb9/django/contrib/admin/options.py#L1580|line 1580 of django/contrib/admin/options.py]] resolves the issue. {{{ Request Method: GET Request URL: http://localhost:8000/admin/.../.../.../change/ Django Version: 2.1a1 Python Version: 3.6.5 Template error: In template .../django/contrib/admin/templates/admin/includes/fieldset.html, error at line 7 Key 'full_name' not found in 'UserForm'. Choices are: . 1 :