Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#33175 closed Bug (duplicate)

ForeignKeyRawIdWidget doesn't quote object.pk and generates wrong links.

Reported by: Alexander Pervakov Owned by: nobody
Component: contrib.admin Version: 3.2
Severity: Normal Keywords:
Cc: Triage Stage: Unreviewed
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

When related model use CharField as primary key and it have some special characters, i.e. "_" then (in my case) on TabularInline admin view I've links without proper quoting that guides me to 302 redirect and error message "There is no product with id "some_id$"". Here the $ sign is a quoted _24 that you can see in an example:

# app/models.py
class Product(models.Model):
    id = models.CharField(max_length=100, primary_key=True, null=False)

class Partner(models.Model):
    name = models.CharField(max_length=256)

class PartnerProductRelation(models.Model):
    partner = models.ForeignKey(
        Partner, related_name="product_links", on_delete=models.CASCADE,
    )
    product = models.ForeignKey(
        Product, related_name="partner_links", on_delete=models.CASCADE,
    )

# app/admin.py
class PartnerProductRelationAdmin(admin.TabularInline):
    model = PartnerProductRelation
    extra = 1
    raw_id_fields = ("product",)

class PartnerAdmin(admin.ModelAdmin):
    list_display = ("name",)
    fields = ("name",)
    inlines = [PartnerProductRelationAdmin]

admin.site.register(Partner, PartnerAdmin)

# test_url.py
partner = Partner(id=1, name="Some Partner")
product = Product(id="some_id_24")
PartnerProductRelation(partner=partner, product=product)

url = reverse("admin:app_partner_change", args=(quote(partner.id),))
response = admin_client.get(url)
assert response.content.find(
    b"""<a href="/admin/app/product/some_5Fid_5F24/change/">some_id_24</a>"""
) > -1

Is tests/admin_widgets/tests.py a good place to create the regression?

Also found not-quoted reverse that can lead to the same consequences here django.contrib.admin.options.ModelAdmin.response_change:

        elif "_saveasnew" in request.POST:
            redirect_url = reverse('admin:%s_%s_change' %
                                   (opts.app_label, opts.model_name),
                                   args=(obj.pk,),
                                   current_app=self.admin_site.name)

Attachments (1)

admin_quote_object_pk.diff (828 bytes ) - added by Alexander Pervakov 3 years ago.

Download all attachments as: .zip

Change History (3)

by Alexander Pervakov, 3 years ago

Attachment: admin_quote_object_pk.diff added

comment:1 by Mariusz Felisiak, 3 years ago

Component: Uncategorizedcontrib.admin
Resolution: duplicate
Status: newclosed
Type: UncategorizedBug

Duplicate of #30386.

comment:2 by Mariusz Felisiak, 3 years ago

Summary: ForeignKeyRawIdWidget doesn't use quoting for object.pk and generates unavailable links in adminForeignKeyRawIdWidget doesn't quote object.pk and generates wrong links.
Note: See TracTickets for help on using tickets.
Back to Top