#30702: Form leaks all objects of model
-------------------------------------+-------------------------------------
Reporter: Kevin Olbrich | Owner: nobody
Type: Bug | Status: closed
Component: Forms | Version: 2.2
Severity: Normal | Resolution: invalid
Keywords: form, forms, | Triage Stage:
queryset | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Kevin Olbrich):
Sure, np.
Project:
https://bitbucket.org/code-orange/django-playground-project
(recursive clone!)
Steps to reproduce:
0. Clone, pip, migrate, etc.
1. Create user (initial superadmin is sufficient)
2. Create customer #1 "Allowed Customer Example"
3. Create customer #2 "Super Secret Customer"
4. Add user + "Allowed Customer Example" relation in multitenancy table
5. Access website under /playground/forms/register
6. Enter a domain and choose customer (only "Allowed Customer Example"
will be visible)
7. Submit form
8. Error will be displayed, Customer only shows "Super Secret Customer"
("Allowed Customer Example" missing!).
I can confirm this for SQLite and MySQL.
The user should never be able to see other customers, as the filter is
"MdatCustomers.objects.filter(mdatmultitenancyusers__user=self.user)".
--
Ticket URL: <https://code.djangoproject.com/ticket/30702#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/071.32b01d8b0a2aed4c52179d47e59f80e3%40djangoproject.com.
