From 5b733171813f8ddc7af84abe79f2646204b9c6ca Mon Sep 17 00:00:00 2001 From: Carlton Gibson Date: Mon, 18 Jun 2018 21:36:20 +0200 Subject: Fixed #29502 -- Allowed users with the view permission to use autocomplete_fields. --- docs/ref/contrib/admin/index.txt | 3 +++ 1 file changed, 3 insertions(+) (limited to 'docs/ref') diff --git a/docs/ref/contrib/admin/index.txt b/docs/ref/contrib/admin/index.txt index b4df066e15..d2911456db 100644 --- a/docs/ref/contrib/admin/index.txt +++ b/docs/ref/contrib/admin/index.txt @@ -1117,6 +1117,9 @@ subclass:: You must define :attr:`~ModelAdmin.search_fields` on the related object's ``ModelAdmin`` because the autocomplete search uses it. + To avoid unauthorized data disclosure, users must have the ``view`` or + ``change`` permission to the related object in order to use autocomplete. + Ordering and pagination of the results are controlled by the related ``ModelAdmin``'s :meth:`~ModelAdmin.get_ordering` and :meth:`~ModelAdmin.get_paginator` methods. -- cgit v1.3