mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-09-26 12:09:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed CVE-2019-19118 -- Required edit permissions on parent model for editable inlines in admin.

Browse source 
Thank you to Shen Ying for reporting this issue.
This commit is contained in:
Carlton Gibson 2019-11-14 15:03:26 +01:00
parent 39e39d0ac1
commit 11c5e0609b
10 changed files with 216 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/admin_views/admin.py
View file

@ -1178,12 +1178,3 @@ class ArticleAdmin9(admin.ModelAdmin):
site9 = admin.AdminSite(name='admin9')
site9.register(Article, ArticleAdmin9)
class ArticleAdmin10(admin.ModelAdmin):
def has_change_permission(self, request, obj=None):
return False
site10 = admin.AdminSite(name='admin10')
site10.register(Article, ArticleAdmin10)