[1.5.x] Fixed #23431 -- Allowed inline and hidden references to admin fields.

This fixes a regression introduced by the 53ff096982 security fix.

Thanks to @a1tus for the report and Tim for the review.

refs #23329.

Backport of 342ccbd from master

7 files changed, 69 insertions, 4 deletions

diff --git a/django/contrib/admin/options.py b/django/contrib/admin/options.py
index bc13097951..fa378148e7 100644
--- a/django/contrib/admin/options.py
+++ b/django/contrib/admin/options.py
@@ -276,6 +276,10 @@ class BaseModelAdmin(six.with_metaclass(forms.MediaDefiningClass)):
         return clean_lookup in self.list_filter or clean_lookup == self.date_hierarchy
 
     def to_field_allowed(self, request, to_field):
+        """
+        Returns True if the model associated with this admin should be
+        allowed to be referenced by the specified field.
+        """
         opts = self.model._meta
 
         try:
@@ -285,8 +289,13 @@ class BaseModelAdmin(six.with_metaclass(forms.MediaDefiningClass)):
 
         # Make sure at least one of the models registered for this site
         # references this field through a FK or a M2M relationship.
-        registered_models = self.admin_site._registry
-        for related_object in (opts.get_all_related_objects() +
+        registered_models = set()
+        for model, admin in self.admin_site._registry.items():
+            registered_models.add(model)
+            for inline in admin.inlines:
+                registered_models.add(inline.model)
+
+        for related_object in (opts.get_all_related_objects(include_hidden=True) +
                                opts.get_all_related_many_to_many_objects()):
             related_model = related_object.model
             if (any(issubclass(model, related_model) for model in registered_models) and
diff --git a/docs/releases/1.4.16.txt b/docs/releases/1.4.16.txt
new file mode 100644
index 0000000000..7c6e2675a0
--- /dev/null
+++ b/docs/releases/1.4.16.txt
@@ -0,0 +1,13 @@
+===========================
+Django 1.4.16 release notes
+===========================
+
+*Under development*
+
+Django 1.4.16 fixes a regression in the 1.4.14 security release.
+
+Bugfixes
+========
+
+* Allowed inline and hidden references to admin fields
+  (`#23431 <http://code.djangoproject.com/ticket/23431>`_).
diff --git a/docs/releases/1.5.11.txt b/docs/releases/1.5.11.txt
new file mode 100644
index 0000000000..9a60239c64
--- /dev/null
+++ b/docs/releases/1.5.11.txt
@@ -0,0 +1,13 @@
+===========================
+Django 1.5.11 release notes
+===========================
+
+*Under development*
+
+Django 1.5.11 fixes a regression in the 1.5.9 security release.
+
+Bugfixes
+========
+
+* Allowed inline and hidden references to admin fields
+  (`#23431 <http://code.djangoproject.com/ticket/23431>`_).
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index a9440ef8fb..cc55eb7385 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -25,6 +25,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.5.11
    1.5.10
    1.5.9
    1.5.8
@@ -42,6 +43,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.4.16
    1.4.15
    1.4.14
    1.4.13
diff --git a/tests/regressiontests/admin_views/admin.py b/tests/regressiontests/admin_views/admin.py
index 73a3287e40..d3c199d8c4 100644
--- a/tests/regressiontests/admin_views/admin.py
+++ b/tests/regressiontests/admin_views/admin.py
@@ -28,7 +28,8 @@ from .models import (Article, Chapter, Account, Media, Child, Parent, Picture,
     AdminOrderedField, AdminOrderedModelMethod, AdminOrderedAdminMethod,
     AdminOrderedCallable, Report, Color2, UnorderedObject, MainPrepopulated,
     RelatedPrepopulated, UndeletableObject, UserMessenger, Simple, Choice,
-    ShortMessage, Telegram, ReferencedByParent, ChildOfReferer, M2MReference)
+    ShortMessage, Telegram, ReferencedByParent, ChildOfReferer, M2MReference,
+    ReferencedByInline, InlineReference, InlineReferer)
 
 
 def callable_year(dt_value):
@@ -654,6 +655,14 @@ class ChoiceList(admin.ModelAdmin):
     fields = ['choice']
 
 
+class InlineReferenceInline(admin.TabularInline):
+    model = InlineReference
+
+
+class InlineRefererAdmin(admin.ModelAdmin):
+    inlines = [InlineReferenceInline]
+
+
 site = admin.AdminSite(name="admin")
 site.register(Article, ArticleAdmin)
 site.register(CustomArticle, CustomArticleAdmin)
@@ -706,6 +715,8 @@ site.register(UndeletableObject, UndeletableObjectAdmin)
 site.register(ReferencedByParent)
 site.register(ChildOfReferer)
 site.register(M2MReference)
+site.register(ReferencedByInline)
+site.register(InlineReferer, InlineRefererAdmin)
 
 # We intentionally register Promo and ChapterXtra1 but not Chapter nor ChapterXtra2.
 # That way we cover all four cases:
diff --git a/tests/regressiontests/admin_views/models.py b/tests/regressiontests/admin_views/models.py
index b2684c0ef0..b3130a304f 100644
--- a/tests/regressiontests/admin_views/models.py
+++ b/tests/regressiontests/admin_views/models.py
@@ -696,3 +696,15 @@ class ChildOfReferer(ParentWithFK):
 class M2MReference(models.Model):
     ref = models.ManyToManyField('self')
 
+# Models for #23431
+class ReferencedByInline(models.Model):
+    pass
+
+
+class InlineReference(models.Model):
+    fk = models.ForeignKey(ReferencedByInline, related_name='hidden+')
+
+
+class InlineReferer(models.Model):
+    refs = models.ManyToManyField(InlineReference)
+
diff --git a/tests/regressiontests/admin_views/tests.py b/tests/regressiontests/admin_views/tests.py
index 230fc4abaa..a85f115792 100644
--- a/tests/regressiontests/admin_views/tests.py
+++ b/tests/regressiontests/admin_views/tests.py
@@ -575,11 +575,16 @@ class AdminViewBasicTest(TestCase):
         response = self.client.get("/test_admin/admin/admin_views/m2mreference/", {TO_FIELD_VAR: 'id'})
         self.assertEqual(response.status_code, 200)
 
-        # Specifying a field that is not refered by any other model directly registered
+        # #23329 - Specifying a field that is not refered by any other model directly registered
         # to this admin site but registered through inheritance should be allowed.
         response = self.client.get("/test_admin/admin/admin_views/referencedbyparent/", {TO_FIELD_VAR: 'id'})
         self.assertEqual(response.status_code, 200)
 
+        # #23431 - Specifying a field that is only refered to by a inline of a registered
+        # model should be allowed.
+        response = self.client.get("/test_admin/admin/admin_views/referencedbyinline/", {TO_FIELD_VAR: 'id'})
+        self.assertEqual(response.status_code, 200)
+
     def test_allowed_filtering_15103(self):
         """
         Regressions test for ticket 15103 - filtering on fields defined in a