mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 10:59:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #29502 -- Allowed users with the view permission to use autocomplete_fields.

Browse source
This commit is contained in:
Carlton Gibson 2018-06-18 21:36:20 +02:00 • committed by Tim Graham
parent 958c7b301e
commit 5b73317181
3 changed files with 16 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/ref/contrib/admin/index.txt
View file

@ -1117,6 +1117,9 @@ subclass::
You must define :attr:`~ModelAdmin.search_fields` on the related object's
``ModelAdmin`` because the autocomplete search uses it.
To avoid unauthorized data disclosure, users must have the ``view`` or
``change`` permission to the related object in order to use autocomplete.
Ordering and pagination of the results are controlled by the related
``ModelAdmin``'s :meth:`~ModelAdmin.get_ordering` and
:meth:`~ModelAdmin.get_paginator` methods.