Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

[1.1.X] Fixed #14999 -- Ensure that filters on local fields are allow…

…ed, and aren't caught as a security problem. Thanks to medhat for the report.

Backport of r15139 from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15176 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit 703dc822565024a65aa9cd3994355577ca8a348b 1 parent cbbfe11
@ramiro ramiro authored
View
2  django/contrib/admin/options.py
@@ -194,6 +194,8 @@ def lookup_allowed(self, lookup):
# later.
return True
else:
+ if len(parts) == 1:
+ return True
clean_lookup = LOOKUP_SEP.join(parts)
return clean_lookup in self.list_filter or clean_lookup == self.date_hierarchy
View
1  tests/regressiontests/admin_views/models.py
@@ -168,6 +168,7 @@ class Person(models.Model):
)
name = models.CharField(max_length=100)
gender = models.IntegerField(choices=GENDER_CHOICES)
+ age = models.IntegerField(default=21)
alive = models.BooleanField()
def __unicode__(self):
View
7 tests/regressiontests/admin_views/tests.py
@@ -295,6 +295,11 @@ def test_disallowed_filtering(self):
self.client.get, "/test_admin/admin/admin_views/album/?owner__email__startswith=fuzzy"
)
+ try:
+ self.client.get("/test_admin/admin/admin_views/person/?age__gt=30")
+ except SuspiciousOperation:
+ self.fail("Filters should be allowed if they involve a local field without the need to whitelist them in list_filter or date_hierarchy.")
+
class SaveAsTests(TestCase):
fixtures = ['admin-views-users.xml','admin-views-person.xml']
@@ -306,7 +311,7 @@ def tearDown(self):
def test_save_as_duplication(self):
"""Ensure save as actually creates a new person"""
- post_data = {'_saveasnew':'', 'name':'John M', 'gender':1}
+ post_data = {'_saveasnew':'', 'name':'John M', 'gender':1, 'age': 42}
response = self.client.post('/test_admin/admin/admin_views/person/1/', post_data)
self.assertEqual(len(Person.objects.filter(name='John M')), 1)
self.assertEqual(len(Person.objects.filter(id=1)), 1)
Please sign in to comment.
Something went wrong with that request. Please try again.