Opened 7 years ago

Closed 6 years ago

Last modified 4 years ago

#9646 closed (fixed)

contrib.admin does app index page does not check ModelAdmin.has_add_permission(request)

Reported by: tadamcik@… Owned by: nobody
Component: contrib.admin Version: master
Severity: Keywords:
Cc: petar.maric@… Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

The permission checks implemented in the app index page for contrib admin assume that the site is using default Django contrib.auth permssions[1]. On sites with overridden ModelAdmin.has_add_permission [3] this means that the wrong perm string will be checked.

The proposed patch simply makes AdminSite.app_index do the check in the same way as AdminSite.index [2] so that ModelAdmin auth mechanism will be invoked.

[1]: http://code.djangoproject.com/browser/django/trunk/django/contrib/admin/sites.py#L343
[2]: http://code.djangoproject.com/browser/django/trunk/django/contrib/admin/sites.py#L279
[3]: http://code.djangoproject.com/browser/django/trunk/django/contrib/admin/options.py#L211

Attachments (1)

ticket-9646.diff (1.0 KB) - added by tadamcik@… 7 years ago.
Change app_index permission checks to match index's checks

Download all attachments as: .zip

Change History (5)

Changed 7 years ago by tadamcik@…

Change app_index permission checks to match index's checks

comment:1 Changed 6 years ago by jacob

  • milestone set to 1.1
  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Triage Stage changed from Unreviewed to Accepted

comment:2 Changed 6 years ago by petar

  • Cc petar.maric@… added

comment:3 Changed 6 years ago by jacob

  • Resolution set to fixed
  • Status changed from new to closed

This is a dup of #9036, which was fixed in [10451].

comment:4 Changed 4 years ago by jacob

  • milestone 1.1 deleted

Milestone 1.1 deleted

Note: See TracTickets for help on using tickets.
Back to Top