angler-fishThe Vulnerability History Project

Fixed #8936 -- Added a view permission and a read-only admin.

      Co-authored-by: Petr Dlouhy <petr.dlouhy@email.cz>
Co-authored-by: Olivier Dalang <olivier.dalang@gmail.com>
by Nathaniel the Tamarin 2018-05-02 08:39:12 UTC
commit 825f0beda804e48e9197fcf3b0d909f9f548aa47
Django VCC Inline Model Access CVE-2019-19118
django/contrib/admin/helpers.py
+8 -19
django/contrib/admin/options.py
+33 -104
django/contrib/admin/sites.py
+1 -2
django/contrib/admin/static/admin/css/base.css
-5
django/contrib/admin/static/admin/css/forms.css
-17
django/contrib/admin/static/admin/css/responsive.css
+1 -5
django/contrib/admin/static/admin/css/rtl.css
+1 -1
django/contrib/admin/static/admin/img/icon-viewlink.svg
-3
django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js
+1 -1
django/contrib/admin/templates/admin/change_form.html
+1 -1
django/contrib/admin/templates/admin/edit_inline/stacked.html
+2 -2
django/contrib/admin/templates/admin/edit_inline/tabular.html
+2 -2
django/contrib/admin/templates/admin/index.html
+1 -5
django/contrib/admin/templates/admin/related_widget_wrapper.html
+2 -8
django/contrib/admin/templates/admin/submit_line.html
+1 -2
django/contrib/admin/templatetags/admin_modify.py
+5 -15
django/contrib/admin/widgets.py
+17 -11
django/contrib/auth/management/__init__.py
+1 -1
django/db/models/options.py
+1 -1
docs/ref/contrib/admin/actions.txt
-3
docs/ref/contrib/admin/index.txt
+3 -18
docs/ref/models/options.txt
+6 -10
docs/releases/2.1.txt
-43
docs/topics/auth/default.txt
-4
tests/admin_changelist/test_date_hierarchy.py
-6
tests/admin_changelist/tests.py
+2 -37
tests/admin_filters/tests.py
+1 -56
tests/admin_views/admin.py
-4
tests/admin_views/test_templatetags.py
-4
tests/admin_views/tests.py
+3 -144
tests/auth_tests/test_management.py
+2 -2
tests/modeladmin/tests.py
+1 -43
expand_less