Make admin views consistently raise PermissionDenied (403) when lacking model permissions

[Jacob Walls]

The Security Team occasionally gets reports about PK enumeration in admin views. We close them, since:

• admin users are trusted
• if PK obscurity is important, then you should choose unguessable PKs

Usually the reports ask us to consider models for which a staff user lacks view permission.

We would evaluate a public cleanup that makes the various admin views consistent in how they treat nonexistent PKs for staff users lacking view permissions.

Two cases were recently called to our attention:

• The "view_on_site" route (wrapping the contenttypes shortcut) redirects without checking permissions, giving either a 302 or 404, instead of a 403.
• The "history_view" route calls self.get_object() and returns the "does not exist" redirect *before* checking has_view_or_change_permission(), giving a 302 for a missing PK and 403 for an existing one.

These are both in contrast to the autocomplete_view and changeform view, which are more careful to return 403 when users lack view permissions.

[Natalia Bidart]

​PR

[blighj]

This is a great little improvement.

[Natalia Bidart]

Replying to blighj:

This is a great little improvement.

Thank you James! when you have a moment, would you please mark the ticket as ready for checkin? (I can also do it later today if you haven't by then.)

[nessita <124304+nessita@…>]

In 4ea38d54:

Fixed #37160 -- Made admin views raise PermissionDenied consistently.

The admin view_on_site and history views now return an HTTP 403 response
when a staff user lacks view or change permission for the target model,
consistent with the changeform and autocomplete views.

Thanks Bence Nagy for the report.