django1/django/contrib/admin/exceptions.py

from django.core.exceptions import SuspiciousOperation


class DisallowedModelAdminLookup(SuspiciousOperation):
    """Invalid filter was passed to admin view via URL querystring"""
    pass


class DisallowedModelAdminToField(SuspiciousOperation):
    """Invalid to_field was passed to admin view via URL query string"""
    pass
Fixed #19866 -- Added security logger and return 400 for SuspiciousOperation. SuspiciousOperations have been differentiated into subclasses, and are now logged to a 'django.security.*' logger. SuspiciousOperations that reach django.core.handlers.base.BaseHandler will now return a 400 instead of a 500. Thanks to tiwoc for the report, and Carl Meyer and Donald Stufft for review. 2013-05-16 07:14:28 +08:00			`from django.core.exceptions import SuspiciousOperation`


			`class DisallowedModelAdminLookup(SuspiciousOperation):`
			`"""Invalid filter was passed to admin view via URL querystring"""`
			`pass`
Prevented data leakage in contrib.admin via query string manipulation. This is a security fix. Disclosure following shortly. 2014-08-07 12:18:10 +08:00

			`class DisallowedModelAdminToField(SuspiciousOperation):`
			`"""Invalid to_field was passed to admin view via URL query string"""`
			`pass`