Opened 54 minutes ago
Last modified 37 minutes ago
#37357 new Bug
Admin date_hierarchy raises an unhandled exception (500) on an out-of-range year
| Reported by: | Philip Sørensen | Owned by: | |
|---|---|---|---|
| Component: | contrib.admin | Version: | 6.1 |
| Severity: | Normal | Keywords: | date_hierarchy admin changelist |
| Cc: | Philip Sørensen | Triage Stage: | Unreviewed |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
A changelist for a ModelAdmin with date_hierarchy set raises an uncaught exception (HTTP 500) when the <field>year query parameter is out of range,
instead of the intended IncorrectLookupParameters (which the changelist view turns into a harmless redirect to ?e=1).
In django/contrib/admin/views/main.py, ChangeList.get_filters() wraps only the datetime(...) construction in try/except ValueError. The to_date computation that follows is outside the try, and datetime() can raise OverflowError rather than ValueError:
- ?<datefield>year=9999 — datetime(9999, 1, 1) succeeds, then to_date = from_date.replace(year=from_date.year + 1) raises "ValueError: year 10000 is out of range" (outside the try).
- ?<datefield>year=99999999999999999999 — datetime(...) raises "OverflowError: Python int too large to convert to C long" (not caught by except ValueError).
Any authenticated staff user with view permission on such a model can trigger it, and date_hierarchy is a very common admin configuration. Django already
handles OverflowError for this same year-out-of-range int->datetime parsing pattern in views/generic/dates.py, views/static.py, template/defaultfilters.py, and contrib/auth/views.py; the admin copy is the inconsistent one.
Fix: catch (ValueError, OverflowError) and move the to_date computation inside the try. A patch with a regression test in tests/admin_changelist follows as a PR.
Change History (2)
comment:1 by , 41 minutes ago
| Has patch: | set |
|---|
comment:2 by , 37 minutes ago
| Cc: | added |
|---|