Opened 26 hours ago

#35959 new Bug

Admin "Change password" Button Visible with Only "Can view user" Permission

Reported by: Dev Namdev Owned by:
Component: contrib.admin Version: 5.1
Severity: Normal Keywords: Permissions, Admin Interface, Change Password, View User, Permission Bug
Cc: Dev Namdev Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: yes

Description

There seems to be a bug (or design oversight) in the Django admin panel where the "Change password" button is visible to users who only have the Can view user permission. According to Django's permission model, a user who can only view users should not have access to modifying user details, including changing the password.

Steps to reproduce:

  1. Create a superuser and a test user.
  2. Grant the test user only the Can view user permission.
  3. Log in to the admin panel as the test user.
  4. Navigate to the user change page for any user.
  5. Observe that the "Change password" button is visible despite the user having no permission to change user details.

Attachments (2)

Screenshot 2024-12-01 112851.png​ (63.6 KB ) - added by Dev Namdev 26 hours ago.
image-20241201-113218.png​ (35.4 KB ) - added by Dev Namdev 26 hours ago.

Download all attachments as: .zip

Change History (2)

by Dev Namdev, 26 hours ago

Attachment: Screenshot 2024-12-01 112851.png​ added

by Dev Namdev, 26 hours ago

Attachment: image-20241201-113218.png​ added
Note: See TracTickets for help on using tickets.
Back to Top