Admin inlines for auto-created ManyToManyFields are editable if the user only has the view permission

[Jayen Ashar]

From https://code.djangoproject.com/ticket/8060#comment:34

Replying to Will Gordon:

This seems to have regressed in (at least) 2.1. I have 2 view only permissions. I have a ManyToManyField represented in my main model as a TabularInline. But, my user with view only permissions can now add or remove these items at will!

I am having the same issue, so I assume this is a bug. I did not find Will had created a separate ticket.

models.py:

class Photo(models.Model):
    pass

class Report(models.Model):
    photos = models.ManyToManyField(Photo)

admin.py:

        class ReportPhotoInlineModelAdmin(admin.TabularInline):
            model = Report.photos.through
            show_change_link = True

[Carlton Gibson]

OK, yes. Fleshing it out I can reproduce this against 2.1.7 with the models and inline provided.

A user with only the view permission for both Report and Photo can edit the M2M in the inline.

When the M2M is handled as a normal field, rather than an inline, the behaviour is correct.

Elevating to a Release Blocker as a regression and/or a bug in the new view permissions feature.

[Carlton Gibson]

Zip with sample project. load fixture.json to populate database Username: readonly Password:1234567890abc

[Carlton Gibson]

Sample project attached: migrate db; load fixture.json. Log in to admin as readonly with password 1234567890abc.

Navigate to Issue > Report admin. You can adjust the M2M. You shouldn't be able to.

[Tim Graham]

​PR

[Tim Graham <timograham@…>]

In aafdf629:

[2.1.x] Fixed #30289 -- Prevented admin inlines for a ManyToManyField's implicit through model from being editable if the user only has the view permission.

Backport of 8335d59200e4c64dfe3348ea93989d95e0107439 from master.

[Tim Graham <timograham@…>]

In 8335d59:

Fixed #30289 -- Prevented admin inlines for a ManyToManyField's implicit through model from being editable if the user only has the view permission.

[Tim Graham <timograham@…>]

In 917aa55:

[2.2.x] Fixed #30289 -- Prevented admin inlines for a ManyToManyField's implicit through model from being editable if the user only has the view permission.

Backport of 8335d59200e4c64dfe3348ea93989d95e0107439 from master.