mirrors/django
mirrors/django
0
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-11-29 14:46:18 +01:00
Code Issues Releases Wiki Activity

Fixed #17985 -- Documented ModelAdmin.lookup_allowed().

Browse Source
This commit is contained in:
Simon Meers 2017-08-15 10:48:51 +10:00 committed by Tim Graham
parent 11f4c52ec7
commit 60443e84b3
1 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
docs/ref/contrib/admin/index.txt
View File

@ -1742,6 +1742,31 @@ templates used by the :class:`ModelAdmin` views:
kwargs['formset'] = MyAdminFormSet
return super().get_changelist_formset(request, **kwargs)
.. method:: ModelAdmin.lookup_allowed(lookup, value)
The objects in the changelist page can be filtered with lookups from the
URL's query string. This is how :attr:`list_filter` works, for example. The
lookups are similar to what's used in :meth:`.QuerySet.filter` (e.g.
``user__email=user@example.com``). Since the lookups in the query string
can be manipulated by the user, they must be sanitized to prevent
unauthorized data exposure.
The ``lookup_allowed()`` method is given a lookup path from the query string
(e.g. ``'user__email'``) and the corresponding value
(e.g. ``'user@example.com'``), and returns a boolean indicating whether
filtering the changelist's ``QuerySet`` using the parameters is permitted.
If ``lookup_allowed()`` returns ``False``, ``DisallowedModelAdminLookup``
(subclass of :exc:`~django.core.exceptions.SuspiciousOperation`) is raised.
By default, ``lookup_allowed()`` allows access to a model's local fields,
field paths used in :attr:`~ModelAdmin.list_filter` (but not paths from
:meth:`~ModelAdmin.get_list_filter`), and lookups required for
:attr:`~django.db.models.ForeignKey.limit_choices_to` to function
correctly in :attr:`~django.contrib.admin.ModelAdmin.raw_id_fields`.
Override this method to customize the lookups permitted for your
:class:`~django.contrib.admin.ModelAdmin` subclass.
.. method:: ModelAdmin.has_add_permission(request)
Should return ``True`` if adding an object is permitted, ``False``