#29502: AutocompleteJsonView doesn't work if user has "view" but not "change"
-------------------------------------+-------------------------------------
Reporter: Matthew Frazier | Owner: Carlton
| Gibson
Type: Bug | Status: assigned
Component: contrib.admin | Version: 2.1
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Matthew Frazier):
To deal with the inconsistency you mentioned, the autocomplete view for a
model could accept query arguments:
`for_app=[APP]&for_model=[MODEL]&fk=[FOREIGN_KEY]`. If those arguments are
present it would look up the `ModelAdmin` for the indicated app and model,
verify that the user `has_add_permission` or `has_change_permission` on
the indicated model, and verify that `fk` refers to the model being
autocompleted.
This would allow a `ForeignKey` to work the same way whether it was in
`autocomplete_fields` or not, but it would make the patch more involved.
It also introduces a slight security risk: if a model `A` has a
`ForeignKey` to another model `B`, then the user can still look up the
values of `B` even if the `ModelAdmin` to `A` doesn't permit them to edit
the `ForeignKey` to `B`.
Another option that eliminates that security risk, but increases
complexity even more, is to store the models a user needs access to
autocomplete in their session. That is probably too much work with too
much potential security exposure to include in 2.1.0 since the beta is
supposed to go out today.
--
Ticket URL: <https://code.djangoproject.com/ticket/29502#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.2472fcecbec7ae87bc700c75c80d1a2a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
