Admin documentation lists all models, even for users without access to certain applications

[chriscohoat]

By default, the admin docs lists documentation for all models. Some users may not have access to models that are still listed in their entirety.

The easiest way to fix this was to check each model in the model index, and only add the model to the listing if a user has the correct permissions. I'm not sure if this is the correct way to go about this, but I'm submitting the patch for review.

[chriscohoat]

Check user permissions in the admindocs model index.

[chriscohoat]

Updated patch to include model details view.

[chriscohoat]

Removed unnecessary import of forbidden HttpResponse. Default action raises an Http404 so that model names cannot be guessed.

[Jannis Leidel]

Yeah, this seems sensible. The patch you attached seems to have been generated wrong though, in the wrong order.

[Rickard Zachrisson]

Refined patch to be more pythonic in code design.

[Rickard Zachrisson]

Noticed that it's possible to direct access models.

[Rickard Zachrisson]

Added validation for direct access to models to which you have no access

[Rickard Zachrisson]

Added documentation and added to pull request: ​https://github.com/django/django/pull/534

[SAI GANESH S]

​https://github.com/django/django/pull/18783

[Sarah Boyce <42296566+sarahboyce@…>]

In c12bc98:

Fixed #17905 -- Restricted access to model pages in admindocs.

Only users with view or change model permissions can access.
Thank you to Sarah Boyce for the review.