Opened 3 years ago

Last modified 3 years ago

#34301 closed Bug

"show_save_as_new" in admin can add without this permission — at Version 1

Reported by: Equipe de TI da Zara Falcão Owned by: nobody
Component: contrib.admin Version: 4.1
Severity: Normal Keywords: save_as
Cc: Carlton Gibson Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: yes UI/UX: no

Description (last modified by Mariusz Felisiak)

At "django/contrib/admin/templatetags/admin_modify.py" file, line 102, I think you must put one more verification for this tag: "and has_add_permission", because "save_as_new" is a add modification.

I rewrite this for my project:

            "show_save_as_new": not is_popup
            and has_add_permission  # This line that I put!!!
            and has_change_permission
            and change
            and save_as,

Change History (1)

comment:1 by Mariusz Felisiak, 3 years ago

Cc: Carlton Gibson added
Description: modified (diff)
Triage Stage: Unreviewed → Accepted

Thanks for the report. It was previously reported in #5650 and #3817, and #3817 was closed but only with a fix for "Save and add another" (see 825f0beda804e48e9197fcf3b0d909f9f548aa47).

I rewrite this for my project:

           "show_save_as_new": not is_popup
            and has_add_permission  # This line that I put!!!
            and has_change_permission
            and change
            and save_as,

Do we need to check both? Checking only has_add_permission should be enough.

Note: See TracTickets for help on using tickets.
Back to Top