mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-26 23:26:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.5.x] Checked object permissions on admin history view.

Browse Source 
This is a security fix. Disclosure and advisory coming shortly.

Patch by Russell Keith-Magee.
This commit is contained in:
Carl Meyer
2013-02-04 16:57:59 -07:00
parent 2d0c22e02d
commit 0e46c7f7ac
2 changed files with 50 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
tests/regressiontests/admin_views/tests.py
View File

@@ -1103,6 +1103,46 @@ class AdminViewPermissionsTest(TestCase):
self.assertContains(response, 'login-form')
self.client.get('/test_admin/admin/logout/')
def testHistoryView(self):
"""History view should restrict access."""
# add user shoud not be able to view the list of article or change any of them
self.client.get('/test_admin/admin/')
self.client.post('/test_admin/admin/', self.adduser_login)
response = self.client.get('/test_admin/admin/admin_views/article/1/history/')
self.assertEqual(response.status_code, 403)
self.client.get('/test_admin/admin/logout/')
# change user can view all items and edit them
self.client.get('/test_admin/admin/')
self.client.post('/test_admin/admin/', self.changeuser_login)
response = self.client.get('/test_admin/admin/admin_views/article/1/history/')
self.assertEqual(response.status_code, 200)
# Test redirection when using row-level change permissions. Refs #11513.
RowLevelChangePermissionModel.objects.create(id=1, name="odd id")
RowLevelChangePermissionModel.objects.create(id=2, name="even id")
for login_dict in [self.super_login, self.changeuser_login, self.adduser_login, self.deleteuser_login]:
self.client.post('/test_admin/admin/', login_dict)
response = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/1/history/')
self.assertEqual(response.status_code, 403)
response = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/2/history/')
self.assertEqual(response.status_code, 200)
self.client.get('/test_admin/admin/logout/')
for login_dict in [self.joepublic_login, self.no_username_login]:
self.client.post('/test_admin/admin/', login_dict)
response = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/1/history/')
self.assertEqual(response.status_code, 200)
self.assertContains(response, 'login-form')
response = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/2/history/')
self.assertEqual(response.status_code, 200)
self.assertContains(response, 'login-form')
self.client.get('/test_admin/admin/logout/')
def testConditionallyShowAddSectionLink(self):
"""
The foreign key widget should only show the "add related" button if the