#29969: Admin inline with view permission is shown when save_as validation fails
---------------------------------+------------------------------------
Reporter: matijakolaric | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 2.1
Severity: Release blocker | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Description changed by matijakolaric:
Old description:
> How to reproduce:
>
> Make a modeladmin with save_as=True, and one unique field, with an inline
> where the user only has 'view' permission.
>
> Create an instance. Open it, press "save as new". This will result in the
> validation error, as it should, but the inline is shown as editable with
> 3 extra fields (ignoring the actual extra setting).
>
> If the unique field is changed, even if the data is entered in the inline
> form, nothing is saved (so there is no security issue, it just looks
> bad).
New description:
How to reproduce:
Make a modeladmin with save_as=True, and one unique field, with an inline
where the user only has 'view' permission.
Create an instance. Open it, press "save as new".
This will result in the validation error, as it should, but the inline is
shown as editable with empty forms. The number of forms corresponds to the
number of inline forms.
If the unique field is changed, even if the data is entered in the inline
form, nothing is saved (so there is no security issue, it just looks bad).
--
--
Ticket URL: <https://code.djangoproject.com/ticket/29969#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/071.3e65d669060944df7b1984ca4bb425e7%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
