mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2019-19118 -- Required edit permissions on parent model for editable inlines in admin.

Browse Source 
Thank you to Shen Ying for reporting this issue.
This commit is contained in:
Carlton Gibson
2019-11-14 15:03:26 +01:00
parent 39e39d0ac1
commit 11c5e0609b
10 changed files with 216 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tests/admin_views/admin.py
View File

@@ -1178,12 +1178,3 @@ class ArticleAdmin9(admin.ModelAdmin):
site9 = admin.AdminSite(name='admin9')
site9.register(Article, ArticleAdmin9)
class ArticleAdmin10(admin.ModelAdmin):
def has_change_permission(self, request, obj=None):
return False
site10 = admin.AdminSite(name='admin10')
site10.register(Article, ArticleAdmin10)