diff --git a/docs/changelog.rst b/docs/changelog.rst index e0faf1d..9c932e5 100644 --- a/docs/changelog.rst +++ b/docs/changelog.rst @@ -7,6 +7,7 @@ Version 0.5.2 (unreleased) * Fix Grappelli_ breadcrumb support in the views. * Fix unwanted ``___`` handling in the ORM when a field name starts with an underscore; this detects you meant ``relatedfield__ _underscorefield`` instead of ``ClassName___field``. +* Fix missing permission check in the "add type" view. This was caught however in the next step. Version 0.5.1 (2013-07-05) diff --git a/polymorphic/admin.py b/polymorphic/admin.py index b192dee..9bf80de 100644 --- a/polymorphic/admin.py +++ b/polymorphic/admin.py @@ -291,6 +291,9 @@ class PolymorphicParentModelAdmin(admin.ModelAdmin): """ Display a choice form to select which page type to add. """ + if not self.has_add_permission(request): + raise PermissionDenied + extra_qs = '' if request.META['QUERY_STRING']: extra_qs = '&' + request.META['QUERY_STRING']