Commit 703dc822 authored by Ramiro Morales's avatar Ramiro Morales
Browse files

[1.1.X] Fixed #14999 -- Ensure that filters on local fields are allowed, and... 

[1.1.X] Fixed #14999 -- Ensure that filters on local fields are allowed, and aren't caught as a security problem. Thanks to medhat for the report.

Backport of r15139 from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15176 bcc190cf-cafb-0310-a4f2-bffc1f526a37
parent cbbfe113

django/contrib/admin/options.py

+2 −0
Original line number Diff line number Diff line
@@ -194,6 +194,8 @@ class BaseModelAdmin(object): 
            # later.

            return True

        else:

            if len(parts) == 1:

                return True

            clean_lookup = LOOKUP_SEP.join(parts)

            return clean_lookup in self.list_filter or clean_lookup == self.date_hierarchy

tests/regressiontests/admin_views/models.py

+1 −0
Original line number Diff line number Diff line
@@ -168,6 +168,7 @@ class Person(models.Model): 
    )

    name = models.CharField(max_length=100)

    gender = models.IntegerField(choices=GENDER_CHOICES)

    age = models.IntegerField(default=21)

    alive = models.BooleanField()



    def __unicode__(self):

tests/regressiontests/admin_views/tests.py

+6 −1
Original line number Diff line number Diff line
@@ -295,6 +295,11 @@ class AdminViewBasicTest(TestCase): 
            self.client.get, "/test_admin/admin/admin_views/album/?owner__email__startswith=fuzzy"

        )



        try:

            self.client.get("/test_admin/admin/admin_views/person/?age__gt=30")

        except SuspiciousOperation:

            self.fail("Filters should be allowed if they involve a local field without the need to whitelist them in list_filter or date_hierarchy.")



class SaveAsTests(TestCase):

    fixtures = ['admin-views-users.xml','admin-views-person.xml']
@@ -306,7 +311,7 @@ class SaveAsTests(TestCase): 


    def test_save_as_duplication(self):

        """Ensure save as actually creates a new person"""

        post_data = {'_saveasnew':'', 'name':'John M', 'gender':1}

        post_data = {'_saveasnew':'', 'name':'John M', 'gender':1, 'age': 42}

        response = self.client.post('/test_admin/admin/admin_views/person/1/', post_data)

        self.assertEqual(len(Person.objects.filter(name='John M')), 1)

        self.assertEqual(len(Person.objects.filter(id=1)), 1)