Commit d9d4d62d authored by Simon Charette's avatar Simon Charette
Browse files

[1.5.x] Fixed #23431 -- Allowed inline and hidden references to admin fields. 

This fixes a regression introduced by the 53ff0969 security fix.

Thanks to @a1tus for the report and Tim for the review.

refs #23329.

Backport of 342ccbdd from master
parent b8db1ded

django/contrib/admin/options.py

+11 −2
Original line number Diff line number Diff line
@@ -276,6 +276,10 @@ class BaseModelAdmin(six.with_metaclass(forms.MediaDefiningClass)): 
        return clean_lookup in self.list_filter or clean_lookup == self.date_hierarchy



    def to_field_allowed(self, request, to_field):

        """

        Returns True if the model associated with this admin should be

        allowed to be referenced by the specified field.

        """

        opts = self.model._meta



        try:
@@ -285,8 +289,13 @@ class BaseModelAdmin(six.with_metaclass(forms.MediaDefiningClass)): 


        # Make sure at least one of the models registered for this site

        # references this field through a FK or a M2M relationship.

        registered_models = self.admin_site._registry

        for related_object in (opts.get_all_related_objects() +

        registered_models = set()

        for model, admin in self.admin_site._registry.items():

            registered_models.add(model)

            for inline in admin.inlines:

                registered_models.add(inline.model)



        for related_object in (opts.get_all_related_objects(include_hidden=True) +

                               opts.get_all_related_many_to_many_objects()):

            related_model = related_object.model

            if (any(issubclass(model, related_model) for model in registered_models) and

docs/releases/1.4.16.txt

0 → 100644
+13 −0
Original line number Diff line number Diff line 
===========================

Django 1.4.16 release notes

===========================



*Under development*



Django 1.4.16 fixes a regression in the 1.4.14 security release.



Bugfixes

========



* Allowed inline and hidden references to admin fields

  (`#23431 <http://code.djangoproject.com/ticket/23431>`_).

docs/releases/1.5.11.txt

0 → 100644
+13 −0
Original line number Diff line number Diff line 
===========================

Django 1.5.11 release notes

===========================



*Under development*



Django 1.5.11 fixes a regression in the 1.5.9 security release.



Bugfixes

========



* Allowed inline and hidden references to admin fields

  (`#23431 <http://code.djangoproject.com/ticket/23431>`_).

docs/releases/index.txt

+2 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ versions of the documentation contain the release notes for any later releases. 
.. toctree::

   :maxdepth: 1



   1.5.11

   1.5.10

   1.5.9

   1.5.8
@@ -42,6 +43,7 @@ versions of the documentation contain the release notes for any later releases. 
.. toctree::

   :maxdepth: 1



   1.4.16

   1.4.15

   1.4.14

   1.4.13

tests/regressiontests/admin_views/admin.py

+12 −1
Original line number Diff line number Diff line
@@ -28,7 +28,8 @@ from .models import (Article, Chapter, Account, Media, Child, Parent, Picture, 
    AdminOrderedField, AdminOrderedModelMethod, AdminOrderedAdminMethod,

    AdminOrderedCallable, Report, Color2, UnorderedObject, MainPrepopulated,

    RelatedPrepopulated, UndeletableObject, UserMessenger, Simple, Choice,

    ShortMessage, Telegram, ReferencedByParent, ChildOfReferer, M2MReference)

    ShortMessage, Telegram, ReferencedByParent, ChildOfReferer, M2MReference,

    ReferencedByInline, InlineReference, InlineReferer)





def callable_year(dt_value):
@@ -654,6 +655,14 @@ class ChoiceList(admin.ModelAdmin): 
    fields = ['choice']





class InlineReferenceInline(admin.TabularInline):

    model = InlineReference





class InlineRefererAdmin(admin.ModelAdmin):

    inlines = [InlineReferenceInline]





site = admin.AdminSite(name="admin")

site.register(Article, ArticleAdmin)

site.register(CustomArticle, CustomArticleAdmin)
@@ -706,6 +715,8 @@ site.register(UndeletableObject, UndeletableObjectAdmin) 
site.register(ReferencedByParent)

site.register(ChildOfReferer)

site.register(M2MReference)

site.register(ReferencedByInline)

site.register(InlineReferer, InlineRefererAdmin)



# We intentionally register Promo and ChapterXtra1 but not Chapter nor ChapterXtra2.

# That way we cover all four cases: