Opened 87 minutes ago

Last modified 80 minutes ago

#37122 new Uncategorized

JSONField has_changed doesn't reflect disabled correctly

Reported by: alex Owned by:
Component: Uncategorized Version: 6.0
Severity: Normal Keywords:
Cc: Triage Stage: Unreviewed
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: yes UI/UX: no

Description (last modified by alex)

Problem:

A disabled JSONField still reports changes via has_changed.

Why?

def has_changed(self, initial, data):
    # here we miss the check for disabled
    if super().has_changed(initial, data):
        return True
    ...

As we see, has_changed from the base is called and if successful, True is returned. But we have no additional check for disabled.

Fix:

def has_changed(self, initial, data):
    if self.disabled:
        return False
    if super().has_changed(initial, data):
        return True
    ...

This corrupts the changed fields in the history of admin (disabled JSONFields are always shown as changed).

Change History (3)

comment:1 by alex, 86 minutes ago

Description: modified (diff)

comment:2 by alex, 85 minutes ago

Description: modified (diff)

comment:3 by alex, 81 minutes ago

Despite being mostly just informational there is a danger:

it can lead to serious work problems if people check the history of an object and wrongly accuse employees to change values they aren't allowed change or even hack their system.

So please inform in the changelog prominently that disabled JSONFields may appear to have been changed.

Last edited 80 minutes ago by alex (previous) (diff)
Note: See TracTickets for help on using tickets.
Back to Top