From 1f2dd37f6fcefdd10ed44cb233b2e62b520afb38 Mon Sep 17 00:00:00 2001
From: Jon Dufresne <jon.dufresne@gmail.com>
Date: Tue, 26 May 2020 09:51:02 +0200
Subject: [3.0.x] Fixed CVE-2020-13596 -- Fixed potential XSS in admin
 ForeignKeyRawIdWidget.

---
 tests/admin_widgets/models.py | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'tests/admin_widgets/models.py')

diff --git a/tests/admin_widgets/models.py b/tests/admin_widgets/models.py
index b5025fdfd7..88bf2b8fca 100644
--- a/tests/admin_widgets/models.py
+++ b/tests/admin_widgets/models.py
@@ -27,6 +27,14 @@ class Band(models.Model):
         return self.name
 
 
+class UnsafeLimitChoicesTo(models.Model):
+    band = models.ForeignKey(
+        Band,
+        models.CASCADE,
+        limit_choices_to={'name': '"&><escapeme'},
+    )
+
+
 class Album(models.Model):
     band = models.ForeignKey(Band, models.CASCADE)
     featuring = models.ManyToManyField(Band, related_name='featured')
-- 
cgit v1.3