[1.1.X] Fixed #14999 -- Ensure that filters on local fields are allow…

…ed, and aren't caught as a security problem. Thanks to medhat for the report.

Backport of r15139 from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15176 bcc190cf-cafb-0310-a4f2-bffc1f526a37

django/contrib/admin/options.py

@@ -194,6 +194,8 @@ def lookup_allowed(self, lookup):
             # later.
             return True
         else:
+            if len(parts) == 1:
+                return True
             clean_lookup = LOOKUP_SEP.join(parts)
             return clean_lookup in self.list_filter or clean_lookup == self.date_hierarchy
 

tests/regressiontests/admin_views/models.py

@@ -168,6 +168,7 @@ class Person(models.Model):
     )
     name = models.CharField(max_length=100)
     gender = models.IntegerField(choices=GENDER_CHOICES)
+    age = models.IntegerField(default=21)
     alive = models.BooleanField()
 
     def __unicode__(self):

tests/regressiontests/admin_views/tests.py

@@ -295,6 +295,11 @@ def test_disallowed_filtering(self):
             self.client.get, "/test_admin/admin/admin_views/album/?owner__email__startswith=fuzzy"
         )
 
+        try:
+            self.client.get("/test_admin/admin/admin_views/person/?age__gt=30")
+        except SuspiciousOperation:
+            self.fail("Filters should be allowed if they involve a local field without the need to whitelist them in list_filter or date_hierarchy.")
+
 class SaveAsTests(TestCase):
     fixtures = ['admin-views-users.xml','admin-views-person.xml']
 
@@ -306,7 +311,7 @@ def tearDown(self):
 
     def test_save_as_duplication(self):
         """Ensure save as actually creates a new person"""
-        post_data = {'_saveasnew':'', 'name':'John M', 'gender':1}
+        post_data = {'_saveasnew':'', 'name':'John M', 'gender':1, 'age': 42}
         response = self.client.post('/test_admin/admin/admin_views/person/1/', post_data)
         self.assertEqual(len(Person.objects.filter(name='John M')), 1)
         self.assertEqual(len(Person.objects.filter(id=1)), 1)