mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-03-14 11:20:46 +00:00
Code Issues 32 Releases Wiki Activity

[1.11.x] Fixed #17985 -- Documented ModelAdmin.lookup_allowed().

Browse Source 
Backport of 60443e84b38ea3a143b0ef9c05b1e1f39d91ddb5 from master
This commit is contained in:
Simon Meers 2017-08-15 10:48:51 +10:00 committed by Tim Graham
parent ff0b81f3a6
commit 07f73daf6b
1 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
docs/ref/contrib/admin/index.txt
View File

@ -1756,6 +1756,31 @@ templates used by the :class:`ModelAdmin` views:
kwargs['formset'] = MyAdminFormSet
return super(MyModelAdmin, self).get_changelist_formset(request, **kwargs)
.. method:: ModelAdmin.lookup_allowed(lookup, value)
The objects in the changelist page can be filtered with lookups from the
URL's query string. This is how :attr:`list_filter` works, for example. The
lookups are similar to what's used in :meth:`.QuerySet.filter` (e.g.
``user__email=user@example.com``). Since the lookups in the query string
can be manipulated by the user, they must be sanitized to prevent
unauthorized data exposure.
The ``lookup_allowed()`` method is given a lookup path from the query string
(e.g. ``'user__email'``) and the corresponding value
(e.g. ``'user@example.com'``), and returns a boolean indicating whether
filtering the changelist's ``QuerySet`` using the parameters is permitted.
If ``lookup_allowed()`` returns ``False``, ``DisallowedModelAdminLookup``
(subclass of :exc:`~django.core.exceptions.SuspiciousOperation`) is raised.
By default, ``lookup_allowed()`` allows access to a model's local fields,
field paths used in :attr:`~ModelAdmin.list_filter` (but not paths from
:meth:`~ModelAdmin.get_list_filter`), and lookups required for
:attr:`~django.db.models.ForeignKey.limit_choices_to` to function
correctly in :attr:`~django.contrib.admin.ModelAdmin.raw_id_fields`.
Override this method to customize the lookups permitted for your
:class:`~django.contrib.admin.ModelAdmin` subclass.
.. method:: ModelAdmin.has_add_permission(request)
Should return ``True`` if adding an object is permitted, ``False``