#23754: DisallowedModelAdminToField when using get_inline_instances()
---------------------------------+-------------------------------------
Reporter: timgraham | Owner: charettes
Type: Bug | Status: assigned
Component: contrib.admin | Version: 1.4
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+-------------------------------------
Changes (by charettes):
* cc: jphalip (added)
* has_patch: 0 => 1
* severity: Normal => Release blocker
Comment:
#23839 was a duplicate.
After further analysis I think the correct solution would be to backport
the fix proposed by @jphalip there which is to always allow reference to
the primary key of the model instead to avoid documenting
`to_field_allowed()` and expose a security foot-gun.
Since the admin doesn't currently work with many to many through a model
pointing to a non-primary key field (see #23862) the only remaining edge
case would be dealing with dynamically generated inlines with a foreign
key pointing to a non-primary key field. For this case I suggest we follow
comment:1 suggestion to document that `get_inline_instances()` should
always return instances of a subset of the classes defined in `inlines`.
Since the initial `to_field_allowed` patch introduced many regression I'll
try to get feedback from the developer mailing list before committing to
this solution.
Patch should follow shortly.
--
Ticket URL: <https://code.djangoproject.com/ticket/23754#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.c103828fdcb0e4f82443a44f81e561c9%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
