Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fixed #14999 -- Ensure that filters on local fields are allowed, and …

…aren't caught as a security problem. Thanks to medhat for the report.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15139 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 6bd8c14be98815627e740d862b1148d0c4fb1514 1 parent d41bd3f
@freakboy3742 freakboy3742 authored
View
2  django/contrib/admin/options.py
@@ -239,6 +239,8 @@ def lookup_allowed(self, lookup):
# later.
return True
else:
+ if len(parts) == 1:
+ return True
clean_lookup = LOOKUP_SEP.join(parts)
return clean_lookup in self.list_filter or clean_lookup == self.date_hierarchy
View
3  tests/regressiontests/admin_views/models.py
@@ -176,7 +176,7 @@ def __unicode__(self):
return self.title
class ThingAdmin(admin.ModelAdmin):
- list_filter = ('color', 'color__warm', 'color__value')
+ list_filter = ('color__warm', 'color__value')
class Fabric(models.Model):
NG_CHOICES = (
@@ -200,6 +200,7 @@ class Person(models.Model):
)
name = models.CharField(max_length=100)
gender = models.IntegerField(choices=GENDER_CHOICES)
+ age = models.IntegerField(default=21)
alive = models.BooleanField()
def __unicode__(self):
View
10 tests/regressiontests/admin_views/tests.py
@@ -372,10 +372,16 @@ def test_disallowed_filtering(self):
)
try:
- self.client.get("/test_admin/admin/admin_views/stuff/?color__value__startswith=red")
+ self.client.get("/test_admin/admin/admin_views/thing/?color__value__startswith=red")
+ self.client.get("/test_admin/admin/admin_views/thing/?color__value=red")
except SuspiciousOperation:
self.fail("Filters are allowed if explicitly included in list_filter")
+ try:
+ self.client.get("/test_admin/admin/admin_views/person/?age__gt=30")
+ except SuspiciousOperation:
+ self.fail("Filters should be allowed if they involve a local field without the need to whitelist them in list_filter or date_hierarchy.")
+
class SaveAsTests(TestCase):
fixtures = ['admin-views-users.xml','admin-views-person.xml']
@@ -387,7 +393,7 @@ def tearDown(self):
def test_save_as_duplication(self):
"""Ensure save as actually creates a new person"""
- post_data = {'_saveasnew':'', 'name':'John M', 'gender':1}
+ post_data = {'_saveasnew':'', 'name':'John M', 'gender':1, 'age': 42}
response = self.client.post('/test_admin/admin/admin_views/person/1/', post_data)
self.assertEqual(len(Person.objects.filter(name='John M')), 1)
self.assertEqual(len(Person.objects.filter(id=1)), 1)

0 comments on commit 6bd8c14

Please sign in to comment.
Something went wrong with that request. Please try again.