Fix missing permission check in the "add type" view.

The permissions were checked in the next step, so this didn't cause a security issue.
2013-08-20 12:07:29 +02:00
parent 496e2c2cf2
commit b2be0701ca
2 changed files with 4 additions and 0 deletions
@@ -291,6 +291,9 @@ class PolymorphicParentModelAdmin(admin.ModelAdmin):
        """
        Display a choice form to select which page type to add.
        """
+        if not self.has_add_permission(request):
+            raise PermissionDenied
+
        extra_qs = ''
        if request.META['QUERY_STRING']:
            extra_qs = '&' + request.META['QUERY_STRING']