IGNORED_PARAMS customization

[Manuel Saelices]

Several times you "hack" the admin interface and want to use extra GET parameters.

Look at this example:

class FooModelAdmin(admin.ModelAdmin):
     # ...
     def get_list_display(self, request, extra_context=None):
         if request.GET.has_key('hide_columns'):
             return ('pk', )
         return super(FooModelAdmin, self).get_list_display(request, extra_context)

But this is impossible because the "hide_columns" GET parameter is not allowed by security reasons. The allowed parameters (IGNORED_PARAMS global variable) is hardcoded (look at [source:django/trunk/django/contrib/admin/views/main.py#L29 this code]).

Should be good if you should configure this parameters. I don't know if a new setting should be good or maybe a ChangeList.get_ignored_lookup_params() method to do something like that:

class FooChangeList(ChangeList):

    def get_ignored_lookup_params(self):
         return super(FooChangeList, self).get_ignored_lookup_params() +  ['hide_columns']

Of course you can extends the ChangeList and override the ChangeList.get_lookup_params() method but should be better of using a special method for this useful thing.

[Manuel Saelices]

The little patch in django.contrib.admin.views.main module would be something like that:

                 ordering_fields[idx] = 'desc' if pfx == '-' else 'asc'
         return ordering_fields
 
+    def get_ignored_lookup_params(self):
+        return IGNORED_PARAMS
+
     def get_lookup_params(self, use_distinct=False):
         lookup_params = self.params.copy() # a dictionary of the query string
 
-        for ignored in IGNORED_PARAMS:
+        for ignored in self.get_ignored_lookup_params():
             if ignored in lookup_params:
                 del lookup_params[ignored]

[Ernesto Rico-Schmidt]

added patch.

[Manuel Saelices]

nnrcschmdt I was working on this ticket. are you working on this too?

[Ernesto Rico-Schmidt]

No, no. Go ahead.
Please set the owner to yourself.

[Manuel Saelices]

A new patch with tests for the [16345] version

[Manuel Saelices]

I've included in the docs the patch attached to #16195 ticket because I need to make it sense.

[Manuel Saelices]

Patch with the doc and tests

[Stephen Burrows]

I attached a patch with corrections to the docs for language and for clarity. However, I wonder if this is really the solution? Really, shouldn't lookup_params that aren't fields on the model always be ignored? They certainly aren't security risks the same way as other items. get_ignored_lookup_params should only be necessary if (for some reason) there's a conflict between the name of the param you want to handle and one of the fields on the model.

[Vaskevich Aleksander]

Is there any movement on this ticket? May I offer my PR?

[Mariusz Felisiak]

It's been 12 years since the ticket was opened. As far as I'm aware, this is rather niche and monkey patching a module constant is an acceptable approach for the reported issue. It's not worth adding extra hooks.