Fix missing permission check in the "add type" view.

The permissions were checked in the next step,
so this didn't cause a security issue.

docs/changelog.rst

@@ -7,6 +7,7 @@ Version 0.5.2 (unreleased)
 * Fix Grappelli_ breadcrumb support in the views.
 * Fix unwanted ``___`` handling in the ORM when a field name starts with an underscore;
   this detects you meant ``relatedfield__ _underscorefield`` instead of ``ClassName___field``.
+* Fix missing permission check in the "add type" view. This was caught however in the next step.
 
 
 Version 0.5.1 (2013-07-05)

polymorphic/admin.py

@@ -291,6 +291,9 @@ class PolymorphicParentModelAdmin(admin.ModelAdmin):
         """
         Display a choice form to select which page type to add.
         """
+        if not self.has_add_permission(request):
+            raise PermissionDenied
+
         extra_qs = ''
         if request.META['QUERY_STRING']:
             extra_qs = '&' + request.META['QUERY_STRING']