Ticket #29930: 29930.diff

django/contrib/admin/options.py

@@ -1556 +1556 @@
                 new_object = self.save_form(request, form, change=not add)
             else:
                 new_object = form.instance
-            formsets, inline_instances = self._create_formsets(request, new_object, change=not add)
+            formsets_, inline_instances_ = self._create_formsets(request, new_object, change=not add)
+            formsets, inline_instances = [], []
+            for inline, instance in zip(formsets_, inline_instances_):
+                if (inline._has_add_permission(request, new_object) or
+                    inline.has_change_permission(request, new_object) or
+                    inline.has_delete_permission(request, new_object)):
+                        formsets.append(inline)
+                        inline_instances.append(instance)
             if all_valid(formsets) and form_validated:
                 self.save_model(request, new_object, form, not add)
-                self.save_related(request, form, formsets, not add)
+                if False:
+                    self.save_related(request, form, formsets, not add)
                 change_message = self.construct_change_message(request, form, formsets, add)
                 if add:
                     self.log_addition(request, new_object, change_message)

docs/releases/2.1.4.txt

@@ -16 +16 @@
 * Prevented repetitive calls to ``geos_version_tuple()`` in the ``WKBWriter``
   class in an attempt to fix a random crash involving ``LooseVersion``
   (:ticket:`29959`).
+
+* Fixed "Please correct the errors below" error message when editing an object
+  in the admin if the user only has the "view" permission on inlines
+  (:ticket:`29930`).

tests/admin_views/tests.py

@@ -1912 +1912 @@
         new_article = Article.objects.latest('id')
         self.assertRedirects(post, reverse('admin:admin_views_article_change', args=(new_article.pk,)))
 
+    def test_change_view_with_view_only_inlines(self):
+        """
+        User with change permission to a section but view-only for inlines.
+        """
+        self.viewuser.user_permissions.add(get_perm(Section, get_permission_codename('change', Section._meta)))
+        self.client.force_login(self.viewuser)
+        data = {
+            'name': 'Can edit name with view-only inlines',
+            'article_set-TOTAL_FORMS': 3,
+            'article_set-INITIAL_FORMS': 3,
+        }
+        response = self.client.post(reverse('admin:admin_views_section_change', args=(self.s1.pk,)), data)
+        # print(response.content.replace(b'\\n', b'\n'))
+        self.assertRedirects(response, reverse('admin:admin_views_section_changelist'))
+        self.assertEqual(Section.objects.get(pk=self.s1.pk).name, data['name'])
+
     def test_delete_view(self):
         """Delete view should restrict access and actually delete items."""
         delete_dict = {'post': 'yes'}