SortableAdmin does not work with SimpleListFilter

[bmihelac]

When model admin is subclass of SortableAdmin and SimpleListFilter is used FieldError exception is raised.
This is because SimpleListFilter defines parameter_name and SortableAdmin tries to filter by this field.

This is done in:
https://github.com/jazzband/django-admin-sortable/blob/master/adminsortable/admin.py#L56

Workaround is to override get_querystring_filters in SortableAdmin subclass and remove any parameter used in SimpleListFilter.

I have added minimal test case for this issue in https://github.com/bmihelac/django-admin-sortable/tree/tmp/issue-264-SimpleListFilter

To reproduce:

1. run django devserver
2. go to http://127.0.0.1:8000/admin/samples/category/
3. select any value from filter

[michaeljtbrooks]

I've just run into this too...

The offending code is:

class SortableAdminBase(object):
    # ....
    def get_querystring_filters(self, request):
        filters = {}

        for k, v in request.GET.items():
            if k not in IGNORED_PARAMS and k != PAGE_VAR:
                filters[k] = v

        return filters

    def changelist_view(self, request, extra_context=None):
        # ...
        # apply any filters via the querystring
        filters = self.get_querystring_filters(request)

        queryset = self.get_queryset(request).filter(**filters)   # <<< Dangerous

The cause is that SimpleListFilters adopt a parameter name which doesn't relate to the model, but SortableAdmin assumes every get querystring param is a model field lookup to be passed to filter()

In fact, I'd argue that's dangerous code. You're allowing a user with access to the admin to perform arbitrary database queries by shoving them in as a browser querystring:

e.g. Pretend we had these models in an app called "food":

class Supplier(models.Model):
  name = models.CharField(max_length=128)

class Topping(models.Model):
  name = models.CharField(max_length=128)
  from_supplier = models.ForeignKey(Supplier, on_delete=models.CASCADE)

class Pizza(models.Model):
  name = models.CharField(max_length=128)
  toppings = models.ManyToManyField(Topping)
  list_order = models.PositiveIntegerField()

Let's say that the person constructed their application so that chefs can add different types of pizza to the menu, but cannot dictate the available toppings nor where the toppings are supplied from. Let's say the Chef's user only had permission to see the Pizza model admin and did not have permission to see the Toppings admin (they could only pick from what was there),

Now if the chef did this url-hack:

/admin/food/pizza/?toppings__supplier__name=monsanto

He'd be able to deduce information about a Topping that appears that he wasn't supposed to know.