Loading django/contrib/admin/options.py +11 −12 Original line number Diff line number Diff line Loading @@ -150,8 +150,7 @@ class BaseModelAdmin(six.with_metaclass(RenameBaseModelAdminMethods)): # rendered output. formfield can be None if it came from a # OneToOneField with parent_link=True or a M2M intermediary. if formfield and db_field.name not in self.raw_id_fields: related_modeladmin = self.admin_site._registry.get( db_field.rel.to) related_modeladmin = self.admin_site._registry.get(db_field.rel.to) can_add_related = bool(related_modeladmin and related_modeladmin.has_add_permission(request)) formfield.widget = widgets.RelatedFieldWidgetWrapper( Loading Loading @@ -1196,8 +1195,8 @@ class ModelAdmin(BaseModelAdmin): opts = self.model._meta self.message_user(request, _( 'The %(name)s "%(obj)s" was deleted successfully.') % { self.message_user(request, _('The %(name)s "%(obj)s" was deleted successfully.') % { 'name': force_text(opts.verbose_name), 'obj': force_text(obj_display) }, messages.SUCCESS) Loading Loading @@ -1313,8 +1312,8 @@ class ModelAdmin(BaseModelAdmin): raise Http404(_('%(name)s object with primary key %(key)r does not exist.') % {'name': force_text(opts.verbose_name), 'key': escape(object_id)}) if request.method == 'POST' and "_saveasnew" in request.POST: return self.add_view(request, form_url=reverse('admin:%s_%s_add' % (opts.app_label, opts.model_name), return self.add_view(request, form_url=reverse('admin:%s_%s_add' % ( opts.app_label, opts.model_name), current_app=self.admin_site.name)) ModelForm = self.get_form(request, obj) Loading django/contrib/admin/templatetags/admin_list.py +3 −5 Original line number Diff line number Diff line Loading @@ -164,8 +164,7 @@ def result_headers(cl): "url_primary": cl.get_query_string({ORDER_VAR: '.'.join(o_list_primary)}), "url_remove": cl.get_query_string({ORDER_VAR: '.'.join(o_list_remove)}), "url_toggle": cl.get_query_string({ORDER_VAR: '.'.join(o_list_toggle)}), "class_attrib": format_html(' class="{0}"', ' '.join(th_classes)) if th_classes else '', "class_attrib": format_html(' class="{0}"', ' '.join(th_classes)) if th_classes else '', } def _boolean_icon(field_val): Loading Loading @@ -246,8 +245,7 @@ def items_for_result(cl, result, form): link_or_text = format_html( '<a href="{0}"{1}>{2}</a>', url, format_html(' onclick="opener.dismissRelatedLookupPopup(window, '{0}'); return false;"', result_id) if cl.is_popup else '', format_html(' onclick="opener.dismissRelatedLookupPopup(window, '{0}'); return false;"', result_id) if cl.is_popup else '', result_repr) yield format_html('<{0}{1}>{2}</{3}>', Loading django/contrib/admin/templatetags/admin_modify.py +1 −2 Original line number Diff line number Diff line Loading @@ -33,8 +33,7 @@ def submit_row(context): 'show_delete_link': (not is_popup and context['has_delete_permission'] and change and context.get('show_delete', True)), 'show_save_as_new': not is_popup and change and save_as, 'show_save_and_add_another': context['has_add_permission'] and not is_popup and (not save_as or context['add']), 'show_save_and_add_another': context['has_add_permission'] and not is_popup and (not save_as or context['add']), 'show_save_and_continue': not is_popup and context['has_change_permission'], 'is_popup': is_popup, 'show_save': True, Loading django/contrib/auth/tests/test_views.py +11 −9 Original line number Diff line number Diff line Loading @@ -177,7 +177,8 @@ class PasswordResetTest(AuthViewsTestCase): # HTTP_HOST header isn't poisoned. This is done as a check when get_host() # is invoked, but we check here as a practical consequence. with patch_logger('django.security.DisallowedHost', 'error') as logger_calls: response = self.client.post('/password_reset/', response = self.client.post( '/password_reset/', {'email': 'staffmember@example.com'}, HTTP_HOST='www.example:dr.frankenstein@evil.tld' ) Loading @@ -190,7 +191,8 @@ class PasswordResetTest(AuthViewsTestCase): def test_poisoned_http_host_admin_site(self): "Poisoned HTTP_HOST headers can't be used for reset emails on admin views" with patch_logger('django.security.DisallowedHost', 'error') as logger_calls: response = self.client.post('/admin_password_reset/', response = self.client.post( '/admin_password_reset/', {'email': 'staffmember@example.com'}, HTTP_HOST='www.example:dr.frankenstein@evil.tld' ) Loading django/contrib/contenttypes/generic.py +5 −8 Original line number Diff line number Diff line Loading @@ -240,11 +240,9 @@ class GenericRelation(ForeignObject): """ return self.rel.to._base_manager.db_manager(using).filter(**{ "%s__pk" % self.content_type_field_name: ContentType.objects.db_manager(using).get_for_model( "%s__pk" % self.content_type_field_name: ContentType.objects.db_manager(using).get_for_model( self.model, for_concrete_model=self.for_concrete_model).pk, "%s__in" % self.object_id_field_name: [obj.pk for obj in objs] "%s__in" % self.object_id_field_name: [obj.pk for obj in objs] }) Loading Loading @@ -352,8 +350,7 @@ def create_generic_related_manager(superclass): db = self._db or router.db_for_read(self.model, instance=instances[0]) query = { '%s__pk' % self.content_type_field_name: self.content_type.id, '%s__in' % self.object_id_field_name: set(obj._get_pk_val() for obj in instances) '%s__in' % self.object_id_field_name: set(obj._get_pk_val() for obj in instances) } qs = super(GenericRelatedObjectManager, self).get_queryset().using(db).filter(**query) # We (possibly) need to convert object IDs to the type of the Loading Loading
django/contrib/admin/options.py +11 −12 Original line number Diff line number Diff line Loading @@ -150,8 +150,7 @@ class BaseModelAdmin(six.with_metaclass(RenameBaseModelAdminMethods)): # rendered output. formfield can be None if it came from a # OneToOneField with parent_link=True or a M2M intermediary. if formfield and db_field.name not in self.raw_id_fields: related_modeladmin = self.admin_site._registry.get( db_field.rel.to) related_modeladmin = self.admin_site._registry.get(db_field.rel.to) can_add_related = bool(related_modeladmin and related_modeladmin.has_add_permission(request)) formfield.widget = widgets.RelatedFieldWidgetWrapper( Loading Loading @@ -1196,8 +1195,8 @@ class ModelAdmin(BaseModelAdmin): opts = self.model._meta self.message_user(request, _( 'The %(name)s "%(obj)s" was deleted successfully.') % { self.message_user(request, _('The %(name)s "%(obj)s" was deleted successfully.') % { 'name': force_text(opts.verbose_name), 'obj': force_text(obj_display) }, messages.SUCCESS) Loading Loading @@ -1313,8 +1312,8 @@ class ModelAdmin(BaseModelAdmin): raise Http404(_('%(name)s object with primary key %(key)r does not exist.') % {'name': force_text(opts.verbose_name), 'key': escape(object_id)}) if request.method == 'POST' and "_saveasnew" in request.POST: return self.add_view(request, form_url=reverse('admin:%s_%s_add' % (opts.app_label, opts.model_name), return self.add_view(request, form_url=reverse('admin:%s_%s_add' % ( opts.app_label, opts.model_name), current_app=self.admin_site.name)) ModelForm = self.get_form(request, obj) Loading
django/contrib/admin/templatetags/admin_list.py +3 −5 Original line number Diff line number Diff line Loading @@ -164,8 +164,7 @@ def result_headers(cl): "url_primary": cl.get_query_string({ORDER_VAR: '.'.join(o_list_primary)}), "url_remove": cl.get_query_string({ORDER_VAR: '.'.join(o_list_remove)}), "url_toggle": cl.get_query_string({ORDER_VAR: '.'.join(o_list_toggle)}), "class_attrib": format_html(' class="{0}"', ' '.join(th_classes)) if th_classes else '', "class_attrib": format_html(' class="{0}"', ' '.join(th_classes)) if th_classes else '', } def _boolean_icon(field_val): Loading Loading @@ -246,8 +245,7 @@ def items_for_result(cl, result, form): link_or_text = format_html( '<a href="{0}"{1}>{2}</a>', url, format_html(' onclick="opener.dismissRelatedLookupPopup(window, '{0}'); return false;"', result_id) if cl.is_popup else '', format_html(' onclick="opener.dismissRelatedLookupPopup(window, '{0}'); return false;"', result_id) if cl.is_popup else '', result_repr) yield format_html('<{0}{1}>{2}</{3}>', Loading
django/contrib/admin/templatetags/admin_modify.py +1 −2 Original line number Diff line number Diff line Loading @@ -33,8 +33,7 @@ def submit_row(context): 'show_delete_link': (not is_popup and context['has_delete_permission'] and change and context.get('show_delete', True)), 'show_save_as_new': not is_popup and change and save_as, 'show_save_and_add_another': context['has_add_permission'] and not is_popup and (not save_as or context['add']), 'show_save_and_add_another': context['has_add_permission'] and not is_popup and (not save_as or context['add']), 'show_save_and_continue': not is_popup and context['has_change_permission'], 'is_popup': is_popup, 'show_save': True, Loading
django/contrib/auth/tests/test_views.py +11 −9 Original line number Diff line number Diff line Loading @@ -177,7 +177,8 @@ class PasswordResetTest(AuthViewsTestCase): # HTTP_HOST header isn't poisoned. This is done as a check when get_host() # is invoked, but we check here as a practical consequence. with patch_logger('django.security.DisallowedHost', 'error') as logger_calls: response = self.client.post('/password_reset/', response = self.client.post( '/password_reset/', {'email': 'staffmember@example.com'}, HTTP_HOST='www.example:dr.frankenstein@evil.tld' ) Loading @@ -190,7 +191,8 @@ class PasswordResetTest(AuthViewsTestCase): def test_poisoned_http_host_admin_site(self): "Poisoned HTTP_HOST headers can't be used for reset emails on admin views" with patch_logger('django.security.DisallowedHost', 'error') as logger_calls: response = self.client.post('/admin_password_reset/', response = self.client.post( '/admin_password_reset/', {'email': 'staffmember@example.com'}, HTTP_HOST='www.example:dr.frankenstein@evil.tld' ) Loading
django/contrib/contenttypes/generic.py +5 −8 Original line number Diff line number Diff line Loading @@ -240,11 +240,9 @@ class GenericRelation(ForeignObject): """ return self.rel.to._base_manager.db_manager(using).filter(**{ "%s__pk" % self.content_type_field_name: ContentType.objects.db_manager(using).get_for_model( "%s__pk" % self.content_type_field_name: ContentType.objects.db_manager(using).get_for_model( self.model, for_concrete_model=self.for_concrete_model).pk, "%s__in" % self.object_id_field_name: [obj.pk for obj in objs] "%s__in" % self.object_id_field_name: [obj.pk for obj in objs] }) Loading Loading @@ -352,8 +350,7 @@ def create_generic_related_manager(superclass): db = self._db or router.db_for_read(self.model, instance=instances[0]) query = { '%s__pk' % self.content_type_field_name: self.content_type.id, '%s__in' % self.object_id_field_name: set(obj._get_pk_val() for obj in instances) '%s__in' % self.object_id_field_name: set(obj._get_pk_val() for obj in instances) } qs = super(GenericRelatedObjectManager, self).get_queryset().using(db).filter(**query) # We (possibly) need to convert object IDs to the type of the Loading