diff options
| author | Carlton Gibson <carlton.gibson@noumenal.es> | 2018-06-18 21:36:20 +0200 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2018-06-18 15:36:20 -0400 |
| commit | 5b733171813f8ddc7af84abe79f2646204b9c6ca (patch) | |
| tree | 3d2fe5d90ae2bfd7c613b1cc56e7b50a904a2986 /docs | |
| parent | 958c7b301ead79974db8edd5b9c6588a10a28ae7 (diff) | |
Fixed #29502 -- Allowed users with the view permission to use autocomplete_fields.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ref/contrib/admin/index.txt | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/docs/ref/contrib/admin/index.txt b/docs/ref/contrib/admin/index.txt index b4df066e15..d2911456db 100644 --- a/docs/ref/contrib/admin/index.txt +++ b/docs/ref/contrib/admin/index.txt @@ -1117,6 +1117,9 @@ subclass:: You must define :attr:`~ModelAdmin.search_fields` on the related object's ``ModelAdmin`` because the autocomplete search uses it. + To avoid unauthorized data disclosure, users must have the ``view`` or + ``change`` permission to the related object in order to use autocomplete. + Ordering and pagination of the results are controlled by the related ``ModelAdmin``'s :meth:`~ModelAdmin.get_ordering` and :meth:`~ModelAdmin.get_paginator` methods. |