Opened 54 minutes ago

Last modified 37 minutes ago

#37357 new Bug

Admin date_hierarchy raises an unhandled exception (500) on an out-of-range year

Reported by: Philip Sørensen Owned by:
Component: contrib.admin Version: 6.1
Severity: Normal Keywords: date_hierarchy admin changelist
Cc: Philip Sørensen Triage Stage: Unreviewed
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

A changelist for a ModelAdmin with date_hierarchy set raises an uncaught exception (HTTP 500) when the <field>year query parameter is out of range,

instead of the intended IncorrectLookupParameters (which the changelist view turns into a harmless redirect to ?e=1).

In django/contrib/admin/views/main.py, ChangeList.get_filters() wraps only the datetime(...) construction in try/except ValueError. The to_date computation that follows is outside the try, and datetime() can raise OverflowError rather than ValueError:

  • ?<datefield>year=9999 — datetime(9999, 1, 1) succeeds, then to_date = from_date.replace(year=from_date.year + 1) raises "ValueError: year 10000 is out of range" (outside the try).
  • ?<datefield>year=99999999999999999999 — datetime(...) raises "OverflowError: Python int too large to convert to C long" (not caught by except ValueError).

Any authenticated staff user with view permission on such a model can trigger it, and date_hierarchy is a very common admin configuration. Django already
handles OverflowError for this same year-out-of-range int->datetime parsing pattern in views/generic/dates.py, views/static.py, template/defaultfilters.py, and contrib/auth/views.py; the admin copy is the inconsistent one.

Fix: catch (ValueError, OverflowError) and move the to_date computation inside the try. A patch with a regression test in tests/admin_changelist follows as a PR.

Change History (2)

comment:1 by Philip Sørensen, 41 minutes ago

Has patch: set

comment:2 by Philip Sørensen, 37 minutes ago

Cc: Philip Sørensen added
Note: See TracTickets for help on using tickets.
Back to Top