#29120: Admin autocomplete requires change permission -------------------------------------+------------------------------------- Reporter: Rodrigo | Owner: nobody Pinheiro Marques de Araújo | Type: | Status: new Uncategorized | Component: | Version: 2.0 contrib.admin | Severity: Normal | Keywords: Triage Stage: | Has patch: 0 Unreviewed | Needs documentation: 0 | Needs tests: 0 Patch needs improvement: 0 | Easy pickings: 0 UI/UX: 0 | -------------------------------------+------------------------------------- class ModelA(models.Model): pass
class ModelB(Models.Model): a = models.ForeignKey(ModelA) In django's admin a form can list all related objects without permission need. In the example above, Model B's form if using a ModelChoiceField is possible to lista all A objects. But using a autocomplete field requires change permission to find "A" objects. This different behavior force admin's user to give a different level of permission to your users. To fix this in the AutocompleteView the only permission required should be a logged user and staff member. https://github.com/django/django/blob/ff61a250815d32ff185501a5afef0245fec7d878/django/contrib/admin/views/autocomplete.py#L52 -- Ticket URL: <https://code.djangoproject.com/ticket/29120> Django <https://code.djangoproject.com/> The Web framework for perfectionists with deadlines. -- You received this message because you are subscribed to the Google Groups "Django updates" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-updates+unsubscr...@googlegroups.com. To post to this group, send email to django-updates@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/django-updates/050.482d4bc4a874fffbe97b2dc9090e461f%40djangoproject.com. For more options, visit https://groups.google.com/d/optout.