Opened 4 weeks ago
Last modified 4 weeks ago
#36569 closed Bug
Asymmetric quoting/unquoting of object_ids in ModelAdmin urls breaks with CharField primary keys — at Initial Version
Reported by: | LeGast00n | Owned by: | |
---|---|---|---|
Component: | contrib.admin | Version: | 5.2 |
Severity: | Normal | Keywords: | url generation resolution escaping |
Cc: | LeGast00n | Triage Stage: | Unreviewed |
Has patch: | no | Needs documentation: | no |
Needs tests: | no | Patch needs improvement: | no |
Easy pickings: | no | UI/UX: | no |
Description
Problem
The Django admin consistently applies quote()
when generating URLs for object_id
,
but the inverse unquoting is not applied everywhere during or after URL resolution.
For models with a CharField
primary key containing characters such as _
,
the ChangeList → Change view object links may break, since the value is escaped in the URL
but not properly decoded on request handling.
Steps to reproduce
- Define a model with a
CharField
as the primary key, allowing_
in its values. - Register it in the Django admin.
- Go to the changelist and click the link to a change view.
Observed
- The URL is generated with
quote()
escaping. - Resolution fails, e.g. in changelist links, delete view, or custom admin URLs.
Workarounds
- Overriding
change_view
/delete_view
to apply unquoting before callingsuper()
works in some cases. - For custom admin URLs the problem happens earlier, during URL resolution itself, leaving no straightforward workaround.
Expected
Wherever quote()
is used to build admin URLs, the corresponding unquoting
should also be applied consistently during URL resolution, including for custom admin routes.