010ReviewseniorPython / Django Admin Security真实来源改编 Django

Django Admin：调整 Save as new 的展示条件

审查一个 Django admin PR：作者认为 Save as new 位于修改页，因此有 change 权限的用户也应该能看到这个动作。

diff --git a/django/contrib/admin/templatetags/admin_modify.py b/django/contrib/admin/templatetags/admin_modify.py@@             "show_save_as_new": not is_popup-            and has_add_permission             and has_change_permission             and change             and save_as,@@+def test_save_as_new_with_change_permission(self):+    context = self.make_context(has_change_permission=True, has_add_permission=False)+    row = submit_row(context)+    self.assertIs(row['show_save_as_new'], True)

PR 说明codegen-agent · CI passed

Allow Save as new when a user can change the object

The admin change form currently hides Save as new unless the user has add permission, even though the button is rendered while editing an existing object. This is confusing for staff who can maintain existing records but do not have broad add access.

This PR treats Save as new as part of the change form action set: if the user can change the current object and save_as is enabled, the button is shown. The popup and change-form guards stay in place.

Added a submit_row regression test for a change-only user so the template context exposes show_save_as_new. Existing admin tests pass.

背景3 条

Django admin has separate add and change permissions. A user who can edit an existing object is not necessarily allowed to create a new object.

The Save as new control appears on a change form, but its result is a newly created object derived from the current one.

The review context includes the pre-patch submit_row() template-context logic in src-admin-modify.py.