
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
django-admin-commander
Advanced tools
A Django app to run management commands from the admin panel with action logging and permission control.
pip install django-admin-commander
Add "django_admin_commander"
to the end of INSTALLED_APPS
in your project's settings.py
:
INSTALLED_APPS = [
...,
"django_admin_commander",
]
Run python manage.py migrate
to register the dummy command model.
Next, add a setting named ADMIN_COMMANDS
to your project's settings.py. This setting should be a dictionary where:
"__all__"
to enable all commands for the app, or an iterable of strings specifying which commands to show.To enable general Django commands, use the app name "django.core"
. For example:
ADMIN_COMMANDS = {
"django.contrib.staticfiles": "__all__",
"django.core": ["check", "diffsettings"],
"django.contrib.sessions": "__all__",
}
That's it! Now, when you access the admin panel with the custom permission enabled explicitly or as a superuser
, you'll see a section for running management commands. Commands you've executed will also appear in your recent actions panel:
Clicking View
or Run Management Commands
opens a view where you can choose and execute the enabled commands.
Once selected, the command usage info is automatically displayed below the Run Command
button:
You can pass any command arguments in the Arguments
field.
If the command expects user input, it can be provided in the User Input
field and will be passed to the command when prompted.
[!NOTE] If you don't want to allow input to be passed to the command prompt, you can disable the
User Input
field entirely by setting ADMIN_COMMANDS_ALLOW_USER_INPUT toFalse
in your project'ssettings.py
.
After execution, the result is displayed as a message at the top of the screen:
[!CAUTION] Some commands are not suited to be run this way and may cause the response process to hang. For example, the
django.core
commandtest
. It's your responsibility to enable only the commands you actually want to run from the admin panel.
Clicking the History
button (with the appropriate permission or as a superuser
) lets you view all log entries for executed commands:
In addition to standard admin view checks, django-admin-commander
verifies whether the user has the custom run_management_command
permission before allowing access to the run command view or executing commands:
If the user is not a superuser
, this permission must be explicitly granted.
To access the History
view, the user must be a superuser
or have the default Django "admin.view_logentry"
permission.
List of available settings:
ADMIN_COMMANDS
A dictionary where keys are app names and values are either `'__all__'` to show all commands for the app or an iterable of command names to show. Default is an empty dictionary.
ADMIN_COMMANDS_ALLOW_USER_INPUT
Set to `True` to allow user input to be passed to the command's stdin when prompted. Set to `False` to disable the field. Default is `True`.
FAQs
A Django app to run management commands from the admin panel
We found that django-admin-commander demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.