diff options
| author | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-04-08 09:30:10 -0400 |
|---|---|---|
| committer | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-04-08 13:38:07 -0400 |
| commit | 0d2352fa1ee4da945cf09b8df31b4c7d56b741a6 (patch) | |
| tree | 46c98dc21e145c81a36a7ca84477c616791c5581 | |
| parent | f5e7c4b8dcec15802d21a1b013bccd8536cc30e5 (diff) | |
[6.0.x] Refs CVE-2026-4292 -- Isolated new test in AdminViewListEditable.
As originally written, this test interfered with
admin_views.tests.SeleniumTests.test_inline_uuid_pk_add_with_popup.
To fix this, register the new ModelAdmin with a different AdminSite.
Backport of 280256499c5b2d636949f3c8cb52159a8e4c26bb from main.
| -rw-r--r-- | tests/admin_views/admin.py | 5 | ||||
| -rw-r--r-- | tests/admin_views/tests.py | 2 |
2 files changed, 4 insertions, 3 deletions
diff --git a/tests/admin_views/admin.py b/tests/admin_views/admin.py index f489c3e6f5..6c5a49400f 100644 --- a/tests/admin_views/admin.py +++ b/tests/admin_views/admin.py @@ -364,7 +364,7 @@ class PersonAdmin(admin.ModelAdmin): return super().get_queryset(request).order_by("age") -class ParentWithUUIDPKAdmin(admin.ModelAdmin): +class ParentWithUUIDPKNoAddAdmin(admin.ModelAdmin): list_display = ("id", "title") list_editable = ("title",) @@ -1286,7 +1286,7 @@ site.register(ReferencedByInline) site.register(InlineReferer, InlineRefererAdmin) site.register(ReferencedByGenRel) site.register(GenRelReference) -site.register(ParentWithUUIDPK, ParentWithUUIDPKAdmin) +site.register(ParentWithUUIDPK) site.register(RelatedPrepopulated, search_fields=["name"]) site.register(RelatedWithUUIDPKModel) site.register(ReadOnlyRelatedField, ReadOnlyRelatedFieldAdmin) @@ -1365,6 +1365,7 @@ site2.register(Language) site7 = admin.AdminSite(name="admin7") site7.register(Article, ArticleAdmin2) site7.register(Section) +site7.register(ParentWithUUIDPK, ParentWithUUIDPKNoAddAdmin) site7.register(PrePopulatedPost, PrePopulatedPostReadOnlyAdmin) site7.register( Pizza, diff --git a/tests/admin_views/tests.py b/tests/admin_views/tests.py index db19f75aa9..25abd97329 100644 --- a/tests/admin_views/tests.py +++ b/tests/admin_views/tests.py @@ -4382,7 +4382,7 @@ class AdminViewListEditable(TestCase): "_save": "Save", } # This model admin allows no add permissions. - changelist_url = reverse("admin:admin_views_parentwithuuidpk_changelist") + changelist_url = reverse("admin7:admin_views_parentwithuuidpk_changelist") response = self.client.post(changelist_url, data) self.assertEqual(response.status_code, HTTPStatus.BAD_REQUEST) self.assertEqual(ParentWithUUIDPK.objects.count(), before_count) |
