Fixed #21056 -- AdminSite.app_index no longer blindly accepts any app-labelish input.

1 files changed, 13 insertions, 2 deletions

diff --git a/django/contrib/admin/sites.py b/django/contrib/admin/sites.py
index bb767a6dfa..2dac947fbc 100644
--- a/django/contrib/admin/sites.py
+++ b/django/contrib/admin/sites.py
@@ -232,14 +232,25 @@ class AdminSite(object):
             url(r'^password_change/done/$', wrap(self.password_change_done, cacheable=True), name='password_change_done'),
             url(r'^jsi18n/$', wrap(self.i18n_javascript, cacheable=True), name='jsi18n'),
             url(r'^r/(?P<content_type_id>\d+)/(?P<object_id>.+)/$', wrap(contenttype_views.shortcut), name='view_on_site'),
-            url(r'^(?P<app_label>\w+)/$', wrap(self.app_index), name='app_list'),
         )
 
-        # Add in each model's views.
+        # Add in each model's views, and create a list of valid URLS for the
+        # app_index
+        valid_app_labels = []
         for model, model_admin in six.iteritems(self._registry):
             urlpatterns += patterns('',
                 url(r'^%s/%s/' % (model._meta.app_label, model._meta.model_name), include(model_admin.urls))
             )
+            if model._meta.app_label not in valid_app_labels:
+                valid_app_labels.append(model._meta.app_label)
+
+        # If there were ModelAdmins registered, we should have a list of app
+        # labels for which we need to allow access to the app_index view,
+        if valid_app_labels:
+            regex = r'^(?P<app_label>' + '|'.join(valid_app_labels) + ')/$'
+            urlpatterns += patterns('',
+                url(regex, wrap(self.app_index), name='app_list'),
+            )
         return urlpatterns
 
     @property