JSONField has_changed doesn't reflect disabled correctly

[alex]

Problem:

A disabled JSONField still reports changes via has_changed.

Why?

def has_changed(self, initial, data):
    # here we miss the check for disabled
    if super().has_changed(initial, data):
        return True
    ...

As we see, has_changed from the base is called and if successful, True is returned. But we have no additional check for disabled.

Fix:

def has_changed(self, initial, data):
    if self.disabled:
        return False
    if super().has_changed(initial, data):
        return True
    ...

This corrupts the changed fields in the history of admin (disabled JSONFields are always shown as changed).

[alex]

Despite being mostly just informational there is a danger:

it can lead to serious work problems if people check the history of an object and wrongly accuse employees to change values they aren't allowed change or even hack their system.

[Simon Charette]

There's effectively a bug here based on how forms.Field.has_changed ​is implemented.

Would you be willing to ​submit a patch? Looks like a simple test could be added ​around here.

[Simon Charette]

Vaibhav please give the reporter the chance to answer before claiming the ticket.

[Frick Wu]

Hi I would like to claim and work on this ticket, how do i go about doing that? I tried following the Claim a ticket instructions but cant seem to make it work.

[Jacob Walls]

Sure thing. Use Modify Ticket button, click "assign to" radio button, set your username, Submit changes.

[Simon Charette]

Patch LGTM

[Sarah Boyce <42296566+sarahboyce@…>]

In e26cdc5:

Fixed #37122 -- Updated JSONField has_changed method to check for disabled status.