Inline widget permision is now based on it's foregin key.

[John Lyu]

Use an old example:

in models.py

class Ticket(models.Model):
........

class Action(models.Model):

    ticket = models.ForeignKey(Ticket)
........

in admin.py:

class ActionInline(admin.TabularInline):
    model = Action
    extra=1
    max_num=3

class TicketAdmin(admin.ModelAdmin):

.........
        inlines = [
        ActionInline,
        ]

In version 2.1.15:

If I set current user's permisson edit_Action but no edit Ticket, I will not be able to edit actions inlines in "Change Ticket" page.

Based on ​https://docs.djangoproject.com/en/3.0/releases/2.1.15/, that bug fix is rude and confusing.

In fact, I can still change Action it self and indirectly "change" the page of it's parent Ticket. We should stop trigger save method in this condition instead of disable the feature.

[Mariusz Felisiak]

I don't agree that this solution is rude. The rationale behind the Security Team decision is included in the release notes and there is not much to add.