summaryrefslogtreecommitdiff
path: root/tests/admin_utils
AgeCommit message (Collapse)Author
12 daysFixed CVE-2026-113733 -- Fixed password hash disclosure to "view only" admin ↵Natalia
users with custom user models. Since Django 6.0, the admin obfuscated the password hash only when the field's model was exactly AUTH_USER_MODEL. Other user models, and user models inheriting the password field from a concrete parent model, failed that check, so the full hash was displayed to users with only the view permission. Thanks to Aaron chen for the report, and Jake Howard for the review.
2026-08-27Fixed #37255 -- Avoided relying on implicit SELECT ordering in tests.viralpraxis
Many (~70) tests assert a specific row order for querysets whose SQL has no ORDER BY. SQL standard does not define that order. On PostgreSQL the rows usually arrive in physical storage order, which on a freshly loaded table matches insertion order -- so these assertions pass by coincidence rather than by contract. That breaks when rows are updated or deleted and the space is reused, or when the planner picks a different access path such as an index scan. A test like this can start failing with no change to Django or to the test itself. The patch made sure that most of these tests do not rely on unspecified unordered selection order.
2026-08-04Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before ↵Natalia
rendering admin links. The admin renders URLField values as clickable links on changelists and read-only change forms. The link was built without validating the URL, so a potentially dangerous stored value could be rendered as a link that runs script in a staff member's authenticated session when clicked. The admin renders URLField values as clickable links on changelists and read-only change forms. The link was built without validating the URL, so a stored value using a potentially dangerous value was rendered as a link, which could lead to cross-site scripting in an authenticated admin session. Refs CVE-2019-12308, #36032. Thanks to Egor Saltykov for the report, and Sarah Boyce for reviews.
2026-07-29Fixed #27752 -- Fixed ordering by Model.__str__ in the admin.VIZZARD-X
Co-authored-by: blighj <blighj@users.noreply.github.com>
2026-07-28Fixed #37230 -- Fixed a crash for second-degree relations in ↵Zubair Hassan
ModelAdmin.list_display. Thanks Rob Kuipers for the report. Regression in 4b2b4bf0ac2707dc9c4d51cabfa72168eaea95fe. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-06-18Fixed #37168 -- Made admin display database defaults as empty values.Mariusz Felisiak
2026-02-20Fixed #36127 -- Applied default empty display value to links otherwise ↵SiHyunLee
containing only whitespace in admin.
2026-02-10Modified tests to format PKs with %s rather than %d.Tim Graham
It's how Django formats values internally and makes tests compatible with databases that use non-integer primary keys.
2025-11-23Refs #21961 -- Added DatabaseFeatures.supports_on_delete_db_(cascade/null) ↵Tim Graham
feature flags. Needed on MongoDB. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2025-10-18Fixed #21961 -- Added support for database-level delete options for ForeignKey.Mariusz Felisiak
Thanks Simon Charette for pair programming. Co-authored-by: Nick Stefan <NickStefan12@gmail.com> Co-authored-by: Akash Kumar Sen <71623442+Akash-Kumar-Sen@users.noreply.github.com> Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-04-17Fixed #35959 -- Displayed password reset button in admin only when user has ↵Sarah Boyce
sufficient permissions. This change ensures that the "Reset password" button in the admin is shown only when the user has the necessary permission to perform a password change operation. It reuses the password hashing rendering logic in `display_for_field` to show the appropriate read-only widget for users with view-only access.
2025-03-12Fixed #36234 -- Restored single_object argument to ↵Adam Johnson
LogEntry.objects.log_actions(). Thank you Adam Johnson for the report and fix. Thank you Sarah Boyce for your spot on analysis. Regression in c09bceef68e5abb79accedd12dade16aa6577a09, which is partially reverted in this branch. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2025-03-04Fixed #36217 -- Restored pre_save/post_save signal emission via ↵antoliny0919
LogEntry.save() for single-object deletion in the admin. Regression in 40b3975e7d3e1464a733c69171ad7d38f8814280. Thanks smiling-watermelon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2025-01-15Refs #34462 -- Removed ModelAdmin.log_deletion() and ↵Sarah Boyce
LogEntryManager.log_action() per deprecation timeline.
2025-01-10Fixed #36032 -- Rendered URLField values as links in the admin.antoliny0919
2024-08-28Fixed #35666 -- Documented stacklevel usage and testing, and adjusted test ↵Simon Charette
suite accordingly. Over the years we've had multiple instances of hit and misses when emitting warnings: either setting the wrong stacklevel or not setting it at all. This work adds assertions for the existing warnings that were declaring the correct stacklevel, but were lacking tests for it.
2024-02-05Fixed #10743 -- Allowed lookups for related fields in ModelAdmin.list_display.Tom Carrick
Co-authored-by: Alex Garcia <me@alexoteiza.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Nina Menezes <https://github.com/nmenezes0>
2024-01-11Refs #28404 -- Made displaying property values in admin respect non-None ↵Alexander Lazarević
empty values.
2024-01-10Fixed #28404 -- Made displaying values in admin respect Field's empty_values.Alexander Lazarević
2024-01-09Refs #28404 -- Split test_null_display_for_field() test.Alexander Lazarević
2023-10-31Fixed #34462 -- Made admin log actions in bulk.Akash Kumar Sen
This also deprecates ModelAdmin.log_deletion() and LogEntryManager.log_action().
2023-08-22Removed unnecessary trailing commas in tests.konsti
2023-03-16Fixed #1873 -- Handled multi-valued query parameters in admin changelist ↵sarahboyce
filters.
2023-02-08Fixed #34303 –- Allowed customizing admin site log entry list.Jacob Rief
Added AdminSite.get_log_entries() as an override point and made this available to the template via each_context().
2023-02-01Refs #33476 -- Applied Black's 2023 stable style.David Smith
Black 23.1.0 is released which, as the first release of the year, introduces the 2023 stable style. This incorporates most of last year's preview style. https://github.com/psf/black/releases/tag/23.1.0
2022-10-07Replaced assertQuerysetEqual() to assertSequenceEqual()/assertCountEqual() ↵Mariusz Felisiak
where appropriate. Follow up to 3f7b3275627385f8f7531fca01cdda50d4ec6b6e.
2022-02-07Refs #33476 -- Refactored code to strictly match 88 characters line length.Mariusz Felisiak
2022-02-07Refs #33476 -- Reformatted code with Black.django-bot
2021-09-14Fixed #32873 -- Deprecated settings.USE_L10N.Claude Paroz
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-01-14Refs #31369 -- Removed models.NullBooleanField per deprecation timeline.Mariusz Felisiak
2021-01-13Fixed #16117 -- Added decorators for admin action and display functions.Nick Pope
Refs #25134, #32099.
2020-10-09Fixed #32080 -- Fixed displaying Unicode chars in forms.JSONField and ↵Qi Zhao
read-only JSONField values in admin.
2020-06-25Added test for django.contrib.admin.utils.help_text_for_field().Mariusz Felisiak
2020-05-15Refs #31395 -- Relied on setUpTestData() test data isolation in various tests.Simon Charette
2020-05-08Fixed #31157 -- Fixed displaying read-only JSONField values in admin.dbxnr
2020-05-08Refs #31157 -- Added tests for display_for_field() with empty JSONField.dbxnr
2019-06-28Fixed #30400 -- Improved typography of user facing strings.Jon Dufresne
Thanks Claude Paroz for assistance with translations.
2019-06-14Fixed #12952 -- Adjusted admin log change messages to use form labels ↵Sanyam Khurana
instead of field names.
2018-12-31Updated test URL patterns to use path() and re_path().Tim Graham
2018-08-20Fixed #29682 -- Fixed admin change form crash if a view-only model's form ↵Tim Graham
has an extra field.
2018-05-07Fixed #29370 -- Added choices to LogEntry.action_flag field.Nicolas Noé
2018-03-20Fixed #29227 -- Allowed BooleanField to be null=True.Tim Graham
Thanks Lynn Cyrin for contributing to the patch, and Nick Pope for review.
2018-02-07Refs #27795 -- Removed force_bytes/text() usage in tests.Tim Graham
2018-01-21Fixed #29038 -- Removed closing slash from HTML void tags.Jon Dufresne
2018-01-03Fixed #28986 -- Prevented boolean values in admin list display from being ↵Jonas Haag
formatted with thousand separators.
2018-01-03Added display_for_value() tests for boolean values.Jonas Haag
2017-07-29Used assertRaisesMessage() to test Django's error messages.Mads Jensen
2017-06-19Completed test coverage for admin's LogEntry model.Anton Samarchyan
2017-06-09Refs #27953 -- Removed hardcoded uses of Model.__str__() in tests.Collin Anderson
generated by cgit v1.3 (git 2.53.0) at 2026-11-15 23:36:31 +0000