Commit 276ecc72 authored by Luke Plant's avatar Luke Plant
Browse files

[1.2.X] Fixed #15103 - SuspiciousOperation with limit_choices_to and raw_id_fields 

Thanks to natrius for the report.

This patch also fixes some unicode bugs in affected code.

Backport of [15347] from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.2.X@15349 bcc190cf-cafb-0310-a4f2-bffc1f526a37
parent 8ab768f9

django/contrib/admin/options.py

+10 −2
Original line number Diff line number Diff line
@@ -185,7 +185,16 @@ class BaseModelAdmin(object): 
    def get_readonly_fields(self, request, obj=None):

        return self.readonly_fields



    def lookup_allowed(self, lookup):

    def lookup_allowed(self, lookup, value):

        model = self.model

        # Check FKey lookups that are allowed, so that popups produced by

        # ForeignKeyRawIdWidget, on the basis of ForeignKey.limit_choices_to,

        # are allowed to work.

        for l in model._meta.related_fkey_lookups:

            for k, v in widgets.url_params_from_lookup_dict(l).items():

                if k == lookup and v == value:

                    return True



        parts = lookup.split(LOOKUP_SEP)



        # Last term in lookup is a query term (__exact, __startswith etc)
@@ -197,7 +206,6 @@ class BaseModelAdmin(object): 
        # if foo has been specificially included in the lookup list; so

        # drop __id if it is the last part. However, first we need to find

        # the pk attribute name.

        model = self.model

        pk_attr_name = None

        for part in parts[:-1]:

            field, _, _, _ = model._meta.get_field_by_name(part)

django/contrib/admin/views/main.py

+6 −4
Original line number Diff line number Diff line
@@ -179,16 +179,18 @@ class ChangeList(object): 


            # if key ends with __in, split parameter into separate values

            if key.endswith('__in'):

                lookup_params[key] = value.split(',')

                value = value.split(',')

                lookup_params[key] = value



            # if key ends with __isnull, special case '' and false

            if key.endswith('__isnull'):

                if value.lower() in ('', 'false'):

                    lookup_params[key] = False

                    value = False

                else:

                    lookup_params[key] = True

                    value = True

                lookup_params[key] = value



            if not self.model_admin.lookup_allowed(key):

            if not self.model_admin.lookup_allowed(key, value):

                raise SuspiciousOperation(

                    "Filtering by %s not allowed" % key

                )

django/contrib/admin/widgets.py

+22 −15
Original line number Diff line number Diff line
@@ -100,6 +100,23 @@ class AdminFileWidget(forms.FileInput): 
        output.append(super(AdminFileWidget, self).render(name, value, attrs))

        return mark_safe(u''.join(output))



def url_params_from_lookup_dict(lookups):

    """

    Converts the type of lookups specified in a ForeignKey limit_choices_to

    attribute to a dictionary of query parameters

    """

    params = {}

    if lookups and hasattr(lookups, 'items'):

        items = []

        for k, v in lookups.items():

            if isinstance(v, list):

                v = u','.join([str(x) for x in v])

            else:

                v = unicode(v)

            items.append((k, v))

        params.update(dict(items))

    return params



class ForeignKeyRawIdWidget(forms.TextInput):

    """

    A Widget for displaying ForeignKeys in the "raw_id" interface rather than
@@ -116,33 +133,23 @@ class ForeignKeyRawIdWidget(forms.TextInput): 
        related_url = '../../../%s/%s/' % (self.rel.to._meta.app_label, self.rel.to._meta.object_name.lower())

        params = self.url_parameters()

        if params:

            url = '?' + '&'.join(['%s=%s' % (k, v) for k, v in params.items()])

            url = u'?' + u'&'.join([u'%s=%s' % (k, v) for k, v in params.items()])

        else:

            url = ''

            url = u''

        if not attrs.has_key('class'):

            attrs['class'] = 'vForeignKeyRawIdAdminField' # The JavaScript looks for this hook.

        output = [super(ForeignKeyRawIdWidget, self).render(name, value, attrs)]

        # TODO: "id_" is hard-coded here. This should instead use the correct

        # API to determine the ID dynamically.

        output.append('<a href="%s%s" class="related-lookup" id="lookup_id_%s" onclick="return showRelatedObjectLookupPopup(this);"> ' % \

        output.append(u'<a href="%s%s" class="related-lookup" id="lookup_id_%s" onclick="return showRelatedObjectLookupPopup(this);"> ' % \

            (related_url, url, name))

        output.append('<img src="%simg/admin/selector-search.gif" width="16" height="16" alt="%s" /></a>' % (settings.ADMIN_MEDIA_PREFIX, _('Lookup')))

        output.append(u'<img src="%simg/admin/selector-search.gif" width="16" height="16" alt="%s" /></a>' % (settings.ADMIN_MEDIA_PREFIX, _('Lookup')))

        if value:

            output.append(self.label_for_value(value))

        return mark_safe(u''.join(output))



    def base_url_parameters(self):

        params = {}

        if self.rel.limit_choices_to and hasattr(self.rel.limit_choices_to, 'items'):

            items = []

            for k, v in self.rel.limit_choices_to.items():

                if isinstance(v, list):

                    v = ','.join([str(x) for x in v])

                else:

                    v = str(v)

                items.append((k, v))

            params.update(dict(items))

        return params

        return url_params_from_lookup_dict(self.rel.limit_choices_to)



    def url_parameters(self):

        from django.contrib.admin.views.main import TO_FIELD_VAR

django/db/models/fields/related.py

+2 −0
Original line number Diff line number Diff line
@@ -895,6 +895,8 @@ class ForeignKey(RelatedField, Field): 
        # don't get a related descriptor.

        if not self.rel.is_hidden():

            setattr(cls, related.get_accessor_name(), ForeignRelatedObjectsDescriptor(related))

            if self.rel.limit_choices_to:

                cls._meta.related_fkey_lookups.append(self.rel.limit_choices_to)

        if self.rel.field_name is None:

            self.rel.field_name = cls._meta.pk.name

django/db/models/options.py

+4 −0
Original line number Diff line number Diff line
@@ -50,6 +50,10 @@ class Options(object): 
        self.abstract_managers = []

        self.concrete_managers = []



        # List of all lookups defined in ForeignKey 'limit_choices_to' options

        # from *other* models. Needed for some admin checks. Internal use only.

        self.related_fkey_lookups = []



    def contribute_to_class(self, cls, name):

        from django.db import connection

        from django.db.backends.util import truncate_name