From fb61c8a6e902abc885048a1a78592a4bd4329f87 Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Wed, 8 Apr 2026 09:30:10 -0400 Subject: [5.2.x] Refs CVE-2026-4292 -- Isolated new test in AdminViewListEditable. As originally written, this test interfered with admin_views.tests.SeleniumTests.test_inline_uuid_pk_add_with_popup. To fix this, register the new ModelAdmin with a different AdminSite. Backport of 280256499c5b2d636949f3c8cb52159a8e4c26bb from main. --- tests/admin_views/admin.py | 5 +++-- tests/admin_views/tests.py | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/tests/admin_views/admin.py b/tests/admin_views/admin.py index 5ea830b0f7..c18892f715 100644 --- a/tests/admin_views/admin.py +++ b/tests/admin_views/admin.py @@ -363,7 +363,7 @@ class PersonAdmin(admin.ModelAdmin): return super().get_queryset(request).order_by("age") -class ParentWithUUIDPKAdmin(admin.ModelAdmin): +class ParentWithUUIDPKNoAddAdmin(admin.ModelAdmin): list_display = ("id", "title") list_editable = ("title",) @@ -1267,7 +1267,7 @@ site.register(ReferencedByInline) site.register(InlineReferer, InlineRefererAdmin) site.register(ReferencedByGenRel) site.register(GenRelReference) -site.register(ParentWithUUIDPK, ParentWithUUIDPKAdmin) +site.register(ParentWithUUIDPK) site.register(RelatedPrepopulated, search_fields=["name"]) site.register(RelatedWithUUIDPKModel) site.register(ReadOnlyRelatedField, ReadOnlyRelatedFieldAdmin) @@ -1345,6 +1345,7 @@ site2.register(Language) site7 = admin.AdminSite(name="admin7") site7.register(Article, ArticleAdmin2) site7.register(Section) +site7.register(ParentWithUUIDPK, ParentWithUUIDPKNoAddAdmin) site7.register(PrePopulatedPost, PrePopulatedPostReadOnlyAdmin) site7.register( Pizza, diff --git a/tests/admin_views/tests.py b/tests/admin_views/tests.py index 248563277f..db0ea424f7 100644 --- a/tests/admin_views/tests.py +++ b/tests/admin_views/tests.py @@ -4347,7 +4347,7 @@ class AdminViewListEditable(TestCase): "_save": "Save", } # This model admin allows no add permissions. - changelist_url = reverse("admin:admin_views_parentwithuuidpk_changelist") + changelist_url = reverse("admin7:admin_views_parentwithuuidpk_changelist") response = self.client.post(changelist_url, data) self.assertEqual(response.status_code, HTTPStatus.BAD_REQUEST) self.assertEqual(ParentWithUUIDPK.objects.count(), before_count) -- cgit v1.3