diff options
| author | Russell Keith-Magee <russell@keith-magee.com> | 2011-02-19 14:05:07 +0000 |
|---|---|---|
| committer | Russell Keith-Magee <russell@keith-magee.com> | 2011-02-19 14:05:07 +0000 |
| commit | 75a1aaa1f9341e558b6efe9227cf663d55704469 (patch) | |
| tree | 581f4572e45067cc0288a7fdf918b37bc985b269 /django | |
| parent | fe3c9ad55103f8fe473bdcf77d06cb958cbaf217 (diff) | |
Fixed #11513 -- Ensure that the redirect at the end of an object change won't redirect to a page for which the user doesn't have permission. Thanks to rlaager for the report and draft patch, and to Julien Phalip for the final patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15584 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'django')
| -rw-r--r-- | django/contrib/admin/options.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/django/contrib/admin/options.py b/django/contrib/admin/options.py index f7b979bc3d..42c1516691 100644 --- a/django/contrib/admin/options.py +++ b/django/contrib/admin/options.py @@ -766,7 +766,13 @@ class ModelAdmin(BaseModelAdmin): return HttpResponseRedirect("../add/") else: self.message_user(request, msg) - return HttpResponseRedirect("../") + # Figure out where to redirect. If the user has change permission, + # redirect to the change-list page for this object. Otherwise, + # redirect to the admin index. + if self.has_change_permission(request, None): + return HttpResponseRedirect('../') + else: + return HttpResponseRedirect('../../../') def response_action(self, request, queryset): """ |