id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
30334	"extra option for InlineModelAdmin instances should be ""0"" if user is lacking ""add"" permission"	direx	nobody	"When a staff user only has `view` permissions for a particular model displayed through an `InlineModelAdmin`, then `extra` should always be `0`. Otherwise input fields are displayed, even if the user does not have `add` permissions.

Sample:

{{{
class AuthorInline(admin.TabularInline):
    extra = 1
    model = Author

@admin.register(Book)
class BookAdmin(admin.ModelAdmin):
    inlines = [AuthorInline, ]
}}}


When a user who only has `view` permission for `Author` opens the ChangeView of `BookAdmin`, an extra input field for `AuthorInline` is displayed. However the input field should not be displayed, as the user is lacking permissions.

Workaround:

{{{
class AuthorInline(admin.TabularInline):
    extra = 1
    model = Author

    def get_extra(self, request, obj=None, **kwargs):
        if self.has_add_permission(request, obj=None):
            return super().get_extra(request, obj=None, **kwargs)
        else:
            return 0
}}}
"	Cleanup/optimization	closed	contrib.admin	2.2	Normal	worksforme			Accepted	0	0	0	0	0	0