Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#34301 closed Bug (fixed)

"show_save_as_new" in admin can add without this permission

Reported by: Equipe de TI da Zara Falcão Owned by: Frédéric Mheir
Component: contrib.admin Version: 4.1
Severity: Normal Keywords: save_as
Cc: Carlton Gibson Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: yes UI/UX: no

Description (last modified by Mariusz Felisiak)

At "django/contrib/admin/templatetags/admin_modify.py" file, line 102, I think you must put one more verification for this tag: "and has_add_permission", because "save_as_new" is a add modification.

I rewrite this for my project:

            "show_save_as_new": not is_popup
            and has_add_permission  # This line that I put!!!
            and has_change_permission
            and change
            and save_as,

Change History (16)

comment:1 by Mariusz Felisiak, 3 years ago

Cc: Carlton Gibson added
Description: modified (diff)
Triage Stage: Unreviewed → Accepted

Thanks for the report. It was previously reported in #5650 and #3817, and #3817 was closed but only with a fix for "Save and add another" (see 825f0beda804e48e9197fcf3b0d909f9f548aa47).

I rewrite this for my project:

           "show_save_as_new": not is_popup
            and has_add_permission  # This line that I put!!!
            and has_change_permission
            and change
            and save_as,

Do we need to check both? Checking only has_add_permission should be enough.

comment:2 by Neesham, 3 years ago

Owner: changed from nobody to Neesham
Status: new → assigned

in reply to:  2 comment:3 by Equipe de TI da Zara Falcão, 3 years ago

Replying to Neesham:

Yes, because "Save as New" is a save too (current object).

comment:4 by Sufyan Afzal, 3 years ago

Owner: changed from Neesham to Sufyan Afzal

comment:5 by Equipe de TI da Zara Falcão, 3 years ago

Oh, yes! Sorry and tanks ;-)

comment:6 by Frédéric Mheir, 3 years ago

Owner: changed from Sufyan Afzal to Frédéric Mheir

comment:7 by Frédéric Mheir, 3 years ago

Has patch: set

​PR

comment:8 by Tim Graham, 3 years ago

Needs tests: set

A regression test is required.

in reply to:  8 comment:9 by Frédéric Mheir, 3 years ago

Needs tests: unset

Replying to Tim Graham:

A regression test is required.

Added a test.

comment:10 by Mariusz Felisiak, 3 years ago

Needs tests: set

in reply to:  10 ; comment:11 by Frédéric Mheir, 3 years ago

Replying to Mariusz Felisiak:
Hi Mariusz! Thanks a lot for your feedback. By making making a test that ensures "show_save_as_new" tag is False when "has_add_permission" is False (and other conditions True), would that be considered proper regression test? The logic is that only it would pass only with the patch.

in reply to:  11 ; comment:12 by Mariusz Felisiak, 3 years ago

Replying to Frédéric Mheir:

Replying to Mariusz Felisiak:
Hi Mariusz! Thanks a lot for your feedback. By making making a test that ensures "show_save_as_new" tag is False when "has_add_permission" is False (and other conditions True), would that be considered proper regression test? The logic is that only it would pass only with the patch.

Yes, exactly.

in reply to:  12 comment:13 by Frédéric Mheir, 3 years ago

Needs tests: unset

Replying to Mariusz Felisiak:

Replying to Frédéric Mheir:

Replying to Mariusz Felisiak:
Hi Mariusz! Thanks a lot for your feedback. By making making a test that ensures "show_save_as_new" tag is False when "has_add_permission" is False (and other conditions True), would that be considered proper regression test? The logic is that only it would pass only with the patch.

Yes, exactly.

Thanks! Just pushed the changes to the PR.

comment:14 by Mariusz Felisiak, 3 years ago

Triage Stage: Accepted → Ready for checkin

comment:15 by Mariusz Felisiak <felisiak.mariusz@…>, 3 years ago

Resolution: → fixed
Status: assigned → closed

In 2878938:

Fixed #34301 -- Made admin's submit_row check add permission for "Save as new" button.

comment:16 by Mariusz Felisiak <felisiak.mariusz@…>, 3 years ago

In d70b2a88:

[4.2.x] Fixed #34301 -- Made admin's submit_row check add permission for "Save as new" button.

Backport of 2878938626aed211d03db33a9a135c9b1d933069 from main

Note: See TracTickets for help on using tickets.
Back to Top