0

I have a model called "press" with a field for "lab", which is another model. on the admin change page for an object in "press", I can choose the "lab" from a list, or click the green plus sign to add a new one. In development, this works fine.

the choice box: enter image description here

after clicking the 'add' sign IN DEVELOPMENT enter image description here

looks good. BUT, on my actual site, this is what happens. the red is the name of the server/root url of the site enter image description here

This is not the only time this happens. It is every 'plus' button that adds a new item to a foreign key field.

the link on the button in this case was dev: http://.../admin/press/lab/add/?_to_field=id&_popup=1 actual: https://.../admin/press/lab/add/?_to_field=id&_popup=1

everything there looks ok.

ALSO on the actual site, if i click 'add' on the left menu, it works fine. enter image description here

in that case, the link is: https://.../admin/press/lab/add/

is the problem because the first case is a popup? or it doesn't like /?_to_field=id any ideas?

EDIT. i think it's an x-frame options issue. Mine is set to "DENY" in settings.py, because that was advised for keeping things secure. Changing it to "SAMEORIGIN" fixed everything. But, that seems to go against the recommended usage. is there a way to keep things secure and still have the functionality?

anp925
  • 59
  • 4
  • You have some configuration issue such that any links to other places go to https which isn't available. You need to make sure that there are no https links (aside for non-local ones) – ewokx May 11 '21 at 03:45
  • but, https is available. i'm not sure what you mean. – anp925 May 11 '21 at 03:57
  • Either https or http isn't available; but that's only a guess. Without actual configuration code, it's difficult to figure out the issue. – ewokx May 11 '21 at 04:00
  • I found that the problem goes away when I change x-frame-options from 'deny' to 'sameorigin' in settings.py. but, 'deny' is the recommended settings. it's confusing to me. – anp925 May 11 '21 at 04:02
  • I'm glad you got that solved; but the issue is in order to get help, you need to provide a bit more information other than screenshots; normally that'd entail including django configuration code. – ewokx May 11 '21 at 04:05

0 Answers0