Commit f51eab79 authored by Ramiro Morales's avatar Ramiro Morales
Browse files

Fixed #18072 -- Made more admin links use reverse() instead of hard-coded relative URLs. 

Thanks kmike for the report and initial patch for the changelist->edit
object view link URL.

Other affected links include the delete object one and object history
one (in this case the change had been implemented in commit 5a9e127e, this
commit adds admin-quoting of the object PK in a way similar to a222d6e8.)

Refs #15294.
parent 515fd6a5

django/contrib/admin/templates/admin/change_form.html

+1 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ 
{% if change %}{% if not is_popup %}

  <ul class="object-tools">

    {% block object-tools-items %}

    <li><a href="{% url opts|admin_urlname:'history' original.pk %}" class="historylink">{% trans "History" %}</a></li>

    <li><a href="{% url opts|admin_urlname:'history' original.pk|admin_urlquote %}" class="historylink">{% trans "History" %}</a></li>

    {% if has_absolute_url %}<li><a href="{% url 'admin:view_on_site' content_type_id original.pk %}" class="viewsitelink">{% trans "View on site" %}</a></li>{% endif%}

    {% endblock %}

  </ul>

django/contrib/admin/templates/admin/submit_line.html

+3 −3
Original line number Diff line number Diff line 
{% load i18n %}

{% load i18n admin_urls %}

<div class="submit-row">

{% if show_save %}<input type="submit" value="{% trans 'Save' %}" class="default" name="_save" {{ onclick_attrib }}/>{% endif %}

{% if show_delete_link %}<p class="deletelink-box"><a href="delete/" class="deletelink">{% trans "Delete" %}</a></p>{% endif %}

{% if show_delete_link %}<p class="deletelink-box"><a href="{% url opts|admin_urlname:'delete' original.pk|admin_urlquote %}" class="deletelink">{% trans "Delete" %}</a></p>{% endif %}

{% if show_save_as_new %}<input type="submit" value="{% trans 'Save as new' %}" name="_saveasnew" {{ onclick_attrib }}/>{%endif%}

{% if show_save_and_add_another %}<input type="submit" value="{% trans 'Save and add another' %}" name="_addanother" {{ onclick_attrib }}/>{% endif %}

{% if show_save_and_continue %}<input type="submit" value="{% trans 'Save and continue editing' %}" name="_continue" {{ onclick_attrib }}/>{% endif %}

django/contrib/admin/templatetags/admin_modify.py

+5 −1
Original line number Diff line number Diff line
@@ -28,7 +28,8 @@ def submit_row(context): 
    change = context['change']

    is_popup = context['is_popup']

    save_as = context['save_as']

    return {

    ctx = {

        'opts': opts,

        'onclick_attrib': (opts.get_ordered_objects() and change

                            and 'onclick="submitOrderForm();"' or ''),

        'show_delete_link': (not is_popup and context['has_delete_permission']
@@ -40,6 +41,9 @@ def submit_row(context): 
        'is_popup': is_popup,

        'show_save': True

    }

    if context.get('original') is not None:

        ctx['original'] = context['original']

    return ctx



@register.filter

def cell_count(inline_admin_form):

django/contrib/admin/util.py

+3 −3
Original line number Diff line number Diff line
@@ -48,9 +48,9 @@ def prepare_lookup_value(key, value): 
def quote(s):

    """

    Ensure that primary key values do not confuse the admin URLs by escaping

    any '/', '_' and ':' characters. Similar to urllib.quote, except that the

    quoting is slightly different so that it doesn't get automatically

    unquoted by the Web browser.

    any '/', '_' and ':' and similarly problematic characters.

    Similar to urllib.quote, except that the quoting is slightly different so

    that it doesn't get automatically unquoted by the Web browser.

    """

    if not isinstance(s, six.string_types):

        return s

django/contrib/admin/views/main.py

+6 −1
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ from functools import reduce 


from django.core.exceptions import SuspiciousOperation, ImproperlyConfigured

from django.core.paginator import InvalidPage

from django.core.urlresolvers import reverse

from django.db import models

from django.db.models.fields import FieldDoesNotExist

from django.utils.datastructures import SortedDict
@@ -376,4 +377,8 @@ class ChangeList(object): 
            return qs



    def url_for_result(self, result):

        return "%s/" % quote(getattr(result, self.pk_attname))
 
        pk = getattr(result, self.pk_attname)

        return reverse('admin:%s_%s_change' % (self.opts.app_label,

                                               self.opts.module_name),

                       args=(quote(pk),),

                       current_app=self.model_admin.admin_site.name)