#25163: When a user doesn't have permission to an admin page, raise 404 instead
of
redirecting to login
--------------------------------------+------------------------------------
Reporter: adelton | Owner: kswiat
Type: Cleanup/optimization | Status: assigned
Component: contrib.admin | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Comment (by timgraham):
The point about authenticated users seeing less than anonymous users seems
to be a good one. It seems raising 404 instead of redirecting wouldn't
really give any security improvement unless we also raised 404s on all
admin pages (except login) for anonymous users. That could be fairly
inconvenient for users who have their session timeout and try to access
one of the admin pages with a deeper URL. They'd have to navigate back the
login page manually instead of being redirected to login with a "next"
query string parameter.
--
Ticket URL: <https://code.djangoproject.com/ticket/25163#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.8afb94aad56a33338ae283f4b69ddb61%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
