[Django] #37264: Admin popup add view crashes on malformed `_source_model` value

[Django]

#37264: Admin popup add view crashes on malformed `_source_model` value
-----------------------------------------+------------------------------
Reporter: Adam Johnson | Owner: Adam Johnson
Type: Bug | Status: assigned
Component: contrib.admin | Version: 6.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------------
Regression in b1ffa9a9d78b0c2c5ad6ed5a1d84e380d5cfd010 (Fixed #13883 --
Rendered named choice groups with `<optgroup>` in
FilteredSelectMultiple)o.

`ModelAdmin.response_add()` now reads a `_source_model` POST parameter and
unpacks it with:

{{{#!python
app_label, model_name = source_model_name.split(".", 1)
}}}

…before any error handling.
A value without an `app_label.model_name` dot separator raises
`ValueError: not enough values to unpack (expected 2, got 1)`, returning
an HTTP 500 '''after the object has already been saved'''.
Any user with add permission can trigger it via a crafted POST or third-
party JavaScript setting a bad value.
In Django 6.0, unknown POST keys were ignored and popup add always
succeeded.

'''Minimal reproduction''': as a user with add permission, POST to any
admin add view with an otherwise valid form plus
`_popup=1&_source_model=foo` (no dot).
The object is saved, then the response is a 500.
--
Ticket URL: <https://code.djangoproject.com/ticket/37264>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#37264: Admin popup add view crashes on malformed `_source_model` value

-------------------------------------+-------------------------------------

Reporter: Adam Johnson | Owner: Adam

Type: | Johnson
Cleanup/optimization | Status: assigned
Component: contrib.admin | Version: 6.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Jacob Walls):

* stage: Unreviewed => Accepted
* type: Bug => Cleanup/optimization

Comment:

Thanks for finding this missed case; let's fix it. I would just chop the
release note, as I don't think we really need to backport this. Additional
views welcome.
--
Ticket URL: <https://code.djangoproject.com/ticket/37264#comment:1>