From 342ccbddc1f2362f867e030befaeb10449cf4539 Mon Sep 17 00:00:00 2001 From: Simon Charette Date: Thu, 4 Sep 2014 17:04:53 -0400 Subject: Fixed #23431 -- Allowed inline and hidden references to admin fields. This fixes a regression introduced by the 53ff096982 security fix. Thanks to @a1tus for the report and Tim for the review. refs #23329. --- django/contrib/admin/options.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'django') diff --git a/django/contrib/admin/options.py b/django/contrib/admin/options.py index 7f6816a172..f7fce09ddc 100644 --- a/django/contrib/admin/options.py +++ b/django/contrib/admin/options.py @@ -439,6 +439,10 @@ class BaseModelAdmin(six.with_metaclass(forms.MediaDefiningClass)): return clean_lookup in valid_lookups def to_field_allowed(self, request, to_field): + """ + Returns True if the model associated with this admin should be + allowed to be referenced by the specified field. + """ opts = self.model._meta try: @@ -448,8 +452,13 @@ class BaseModelAdmin(six.with_metaclass(forms.MediaDefiningClass)): # Make sure at least one of the models registered for this site # references this field through a FK or a M2M relationship. - registered_models = self.admin_site._registry - for related_object in (opts.get_all_related_objects() + + registered_models = set() + for model, admin in self.admin_site._registry.items(): + registered_models.add(model) + for inline in admin.inlines: + registered_models.add(inline.model) + + for related_object in (opts.get_all_related_objects(include_hidden=True) + opts.get_all_related_many_to_many_objects()): related_model = related_object.model if (any(issubclass(model, related_model) for model in registered_models) and -- cgit v1.3