Admin change form actions should only allow applying to object from the change form

[Sarah Boyce]

We had a few security reports against the new admin change form action feature that a user could tamper with the _selected_action value and then run the action against a different object, with concerns that the same user may not be able to view or change that admin object.

I think a BadRequest should be raised if the _selected_action value does not match the url it was sent from

tests/admin_views/test_actions.py

@@ -667 +667 @@
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.content, b"OK")
 
+    def test_action_changeform_cannot_target_different_objects(self):
+        changeform_url = reverse("admin:admin_views_externalsubscriber_change", args=[self.s1.pk])
+        external_subscriber = ExternalSubscriber.objects.create(
+            name="Jane Austin", email="jane@example.org"
+        )
+        for invalid_checkbox_value in [[external_subscriber.pk], [self.s1.pk, external_subscriber.pk]]:
+            with self.subTest(invalid_checkbox_value=invalid_checkbox_value):
+                response = self.client.post(
+                    changeform_url,
+                    {
+                        "CHANGE_FORM-action": "external_mail",
+                        ACTION_CHECKBOX_NAME: invalid_checkbox_value,
+                        "index": 0,
+                    },
+                )
+                self.assertEqual(len(mail.outbox), 0)
+                self.assertEqual(response.status_code, 400)
+
     def test_select_across_ignored(self):

[Jacob Walls <jacobtylerwalls@…>]

In 7c125f6:

Fixed #37105 -- Disallowed admin change form actions on different objects.

Bug in f30acb184f75fd9260cfd6ddc48a3bbbd49f9c1d. Refs #12090.

[nessita <124304+nessita@…>]

In a53e02a:

Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions.

Refs #37105, #12090.

[Natalia <124304+nessita@…>]

In 1825a1c5:

[6.1.x] Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions.

Refs #37105, #12090.

Backport of a53e02af6d7a07d0367b534f7107a0e2a37e3d34 from main.