django.git/django/contrib/admin/options.py, branch 5.2.13

[5.2.x] Fixed CVE-2026-4292 -- Disallowed instance creation via ModelAdmin.list_editable.

2026-04-07T11:33:08Z

Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews. Backport of 6afe7ce93964f56e33a29d477c269436f9b60cbf from main.

[5.2.x] Fixed #36234 -- Restored single_object argument to LogEntry.objects.log_actions().

2025-03-12T19:36:48Z

Thank you Adam Johnson for the report and fix. Thank you Sarah Boyce for your spot on analysis. Regression in c09bceef68e5abb79accedd12dade16aa6577a09, which is partially reverted in this branch. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 27b68bcadf1ab2e9f7fd223aed42db352ccdc62d from main.

[5.2.x] Fixed #36217 -- Restored pre_save/post_save signal emission via LogEntry.save() for single-object deletion in the admin.

2025-03-04T09:36:37Z

Regression in 40b3975e7d3e1464a733c69171ad7d38f8814280. Thanks smiling-watermelon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of c09bceef68e5abb79accedd12dade16aa6577a09 from main.

Refs #26001 -- Handled relationship exact lookups in ModelAdmin.search_fields.

2024-11-05T08:06:14Z

Fixed #26001 -- Fixed non-string field exact lookups in ModelAdmin.search_fields.

2024-11-04T08:39:47Z

Fixed #35639 -- Improved admin's delete confirmation page title.

2024-08-07T21:10:49Z

Fixed #35606, Refs #34045 -- Fixed rendering of ModelAdmin.action_checkbox for models with a html method.

2024-07-18T06:09:37Z

Thank you Claude Paroz for the report. Regression in 85366fbca723c9b37d0ac9db1d44e3f1cb188db2.

Fixed #35520 -- Avoided opening transaction for read-only ModelAdmin requests.

2024-07-04T09:38:58Z

Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.

2024-05-29T13:48:27Z

This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).

Fixed #35189 -- Improved admin collapsible fieldsets by using
elements.

2024-05-22T03:13:55Z

This work improves the accessibility of the add and change pages in the admin site by adding

and

elements to the collapsible fieldsets. This has the nice side effect of no longer requiring custom JavaScript helpers to implement the fieldsets' show/hide capabilities. Thanks to James Scholes for the accessibility advice, and to Sarah Boyce and Tom Carrick for reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>