django.git/tests/generic_inline_admin/tests.py, branch stable/6.0.x django http://cgit.adnoto.dev/django.git/atom?h=stable%2F6.0.x 2026-04-07T11:20:52Z [6.0.x] Fixed CVE-2026-4277 -- Checked add permissions in GenericInlineModelAdmin. 2026-04-07T11:20:52Z Jacob Walls jacobtylerwalls@gmail.com 2026-03-12T15:00:05Z urn:sha1:08a752c1cd8f378b4c64d96c319da23726df6ed3 Edit permissions were still checked as part of ordinary form validation, but because GenericInlineModelAdmin overrides get_formset(), it lacked InlineModelAdmin's dynamic DeleteProtectedModelForm.has_changed() logic for checking permissions server-side, leaving the add case unaddressed. This change reimplements the relevant part of InlineModelAdmin.get_formset(). Thanks N05ec@LZU-DSLab for the report, and Natalia Bidart, Markus Holtermann, and Simon Charette for reviews. Backport of ef8b25dcc06d158683a5623ce406d561638f4073 from main. Refs #34380 -- Changed the URLField default scheme to https and removed FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline. 2025-01-15T21:28:37Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-12-12T16:39:58Z urn:sha1:9a3f86e96009c1137b286f6d579b9d812a0dee69 Removed unnecessary trailing commas in tests. 2023-08-22T10:42:57Z konsti konstin@mailbox.org 2023-08-22T10:42:57Z urn:sha1:48a1929ca050f1333927860ff561f6371706968a Fixed #34380 -- Allowed specifying a default URL scheme in forms.URLField. 2023-04-28T04:58:10Z Coen van der Kamp coen@fourdigits.nl 2023-03-08T19:12:34Z urn:sha1:7bbbadc69383f0a2b99253e153b974f8783e876d This also deprecates "http" as the default scheme. Refs #33476 -- Refactored code to strictly match 88 characters line length. 2022-02-07T19:37:05Z Mariusz Felisiak felisiak.mariusz@gmail.com 2022-02-04T07:08:27Z urn:sha1:7119f40c9881666b6f9b5cf7df09ee1d21cc8344 Refs #33476 -- Reformatted code with Black. 2022-02-07T19:37:05Z django-bot ops@djangoproject.com 2022-02-03T19:24:19Z urn:sha1:9c19aff7c7561e3a82978a272ecdaad40dda5c00 Fixed #32003 -- Added obj argument to has_perm() methods in tests. 2020-09-14T10:28:17Z Alexander Todorov atodorov@mrsenko.com 2020-09-14T10:28:17Z urn:sha1:5fab16392fc00702a5d0288378892ec48fe67dc6 Changed `'%s' % value` pattern to `str(value)`. 2020-05-04T06:27:18Z Nick Pope nick.pope@flightdataservices.com 2020-05-01T14:54:15Z urn:sha1:8f10ceaa907f3f608494f782f65070d0bb8b9587 Fixed #27755 -- Added ModelAdmin.get_inlines() hook. 2019-04-17T05:16:04Z Hasan Ramezani hasan.r67@gmail.com 2019-03-19T15:13:26Z urn:sha1:917fd9d03fdd21538864af4b412ac30b36d99268 Renamed camelCaseTestMethods to snake_case_test_methods 2019-04-14T14:14:14Z Markus Holtermann info@markusholtermann.eu 2019-04-14T13:00:48Z urn:sha1:da0b2554ec8e3ef134237b773baed06cd5f8a82f