diff options
| author | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-03-16 18:05:22 -0400 |
|---|---|---|
| committer | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-04-07 07:21:29 -0400 |
| commit | 428c48f358c5a0ed5ca2834fb721d615eb2b0e11 (patch) | |
| tree | 0738e9487163cfaafa0be6402f78f031a88825ce /django/contrib/admin | |
| parent | 08a752c1cd8f378b4c64d96c319da23726df6ed3 (diff) | |
[6.0.x] Fixed CVE-2026-4292 -- Disallowed instance creation via ModelAdmin.list_editable.
Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
Backport of 6afe7ce93964f56e33a29d477c269436f9b60cbf from main.
Diffstat (limited to 'django/contrib/admin')
| -rw-r--r-- | django/contrib/admin/options.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/django/contrib/admin/options.py b/django/contrib/admin/options.py index 6c202c8e61..0d9b62faea 100644 --- a/django/contrib/admin/options.py +++ b/django/contrib/admin/options.py @@ -32,6 +32,7 @@ from django.contrib.admin.utils import ( from django.contrib.admin.widgets import AutocompleteSelect, AutocompleteSelectMultiple from django.contrib.auth import get_permission_codename from django.core.exceptions import ( + BadRequest, FieldDoesNotExist, FieldError, PermissionDenied, @@ -2072,6 +2073,8 @@ class ModelAdmin(BaseModelAdmin): for form in formset.forms: if form.has_changed(): obj = self.save_form(request, form, change=True) + if obj._state.adding: + raise BadRequest("list_editable does not allow adding.") self.save_model(request, obj, form, change=True) self.save_related(request, form, formsets=[], change=True) change_msg = self.construct_change_message( |