Opened 6 years ago

Last modified 6 years ago

#29969 new Bug

Admin inline with view permission is shown when save_as validation fails — at Version 3

Reported by: Matija Kolarić Owned by: nobody
Component: contrib.admin Version: 2.1
Severity: Normal Keywords:
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by Matija Kolarić)

How to reproduce:

Make a modeladmin with save_as=True, and one unique field, with an inline where the user only has 'view' permission.

Create an instance. Open it, press "save as new".

This will result in the validation error, as it should, but the inline is shown as editable with empty forms. The number of forms corresponds to the number of inline forms.

If the unique field is changed, even if the data is entered in the inline form, nothing is saved (so there is no security issue, it just looks bad).

According to the ticket's flags, the next step(s) to move this issue forward are:

  • To provide a patch by sending a pull request. Claim the ticket when you start working so that someone else doesn't duplicate effort. Before sending a pull request, review your work against the patch review checklist. Check the "Has patch" flag on the ticket after sending a pull request and include a link to the pull request in the ticket comment when making that update. The usual format is: [https://github.com/django/django/pull/#### PR].

Change History (3)

comment:1 by Matija Kolarić, 6 years ago

Component: Uncategorized → contrib.admin

comment:2 by Tim Graham, 6 years ago

Severity: Normal → Release blocker
Triage Stage: Unreviewed → Accepted
Type: Uncategorized → Bug

comment:3 by Matija Kolarić, 6 years ago

Description: modified (diff)
Note: See TracTickets for help on using tickets.
Back to Top