View only permissions on stacked inline result in error

[Andre Lesa]

We have an inline on a particular form and we have assigned view only permissions to certain users. When such users try to save the entire form, it results in a cryptic "Please correct the errors below. " message.

So far we have been unable to resolve this. The only solution seems to be the addition of "change" permissions.

[Tim Graham]

Please provide a sample project that reproduces the problem.

[Tim Graham]

I can reproduce using the tutorial. With the change permission to question and view permission to choice, try to edit a question.

[Tim Graham]

I started on a patch but this solution doesn't work because the has_<foo>_permission calls don't exist at that point where they're added. I think the checks need to go in get_inline_formsets() but given the method's arguments and fact that we can't easily change the signature due to backwards compatibility, I couldn't think of a way to know whether or not should the formset should be omitted. request.method == 'POST' might work. I'll probably continue this next week if no one picks it up.

[Matija Kolarić]

Also, likely related to this, if the view has save_as, and there is an error, then, although the user has only view permission for the inline mode, the formset is shown as if the user had add permission, though nothing happens with the entered data. Maybe this requires a new ticket?

[Tim Graham]

Yes, I imagine the fix for that probably requires something else.

[Carlton Gibson]

​PR

[Carlton Gibson]

This one is ready to go. Thanks to Tim & Simon for review.

[GitHub <noreply@…>]

In 8245c99e:

Fixed #29930 -- Allowed editing in admin with view-only inlines.

Co-authored-by: Tim Graham <timograham@…>

[Carlton Gibson <carlton.gibson@…>]

In 27f5b0af:

[2.1.x] Fixed #29930 -- Allowed editing in admin with view-only inlines.

Co-authored-by: Tim Graham <timograham@…>
Backport of 8245c99ee6032c2748ba46583d8cab15b2f9438e from master