mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[2.1.x] Fixed #29487 -- Accounted for object level permissions when calculating change view's read-only fields.

Browse Source 
Thanks Matthew Frazier for the report and fix.

Backport of 553617e613 from master
This commit is contained in:
Paulo
2018-06-15 17:05:44 -04:00
committed by Tim Graham
parent 53be30f828
commit 8cbfaf29c0
4 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/admin_views/tests.py
View File

@@ -1852,6 +1852,18 @@ class AdminViewPermissionsTest(TestCase):
self.assertContains(response, 'login-form')
self.client.get(reverse('admin:logout'))
def test_change_view_without_object_change_permission(self):
"""
The object should be read-only if the user has permission to view it
and change objects of that type but not to change the current object.
"""
change_url = reverse('admin9:admin_views_article_change', args=(self.a1.pk,))
self.client.force_login(self.viewuser)
response = self.client.get(change_url)
self.assertEqual(response.status_code, 200)
self.assertEqual(response.context['title'], 'View article')
self.assertContains(response, '<a href="/test_admin/admin9/admin_views/article/" class="closelink">Close</a>')
def test_change_view_save_as_new(self):
"""
'Save as new' should raise PermissionDenied for users without the 'add'