[Django]-Django: Filtering by %filter% not allowed

This issue has been solved according to the instructions provided at Chris Adams’ blog. Django 1.2.4 introduced a new security feature that limited the ability to use “arbitrary cross-model lookups via querystring” as noted by Daniel Roseman in his answer.

The workaround for this version is to define a lookup_allowed method in FooAdmin (‘PlayerYearAdmin’ in my case) that returns true for all of the filters you wish to enable. In my case, lookup_allowed looked like this:

def lookup_allowed(self, key):
    if key in ('team__season__season_start_date__year', 'team__sport'):
        return True
    return super(PlayerYearAdmin, self).lookup_allowed(key)

You can also bypass the security check altogether, effectively stating that all lookups are allowed. This was the default behavior prior to version 1.2.4:

def lookup_allowed(self, key):
    return True

It may be worth noting that version 1.2.5 added a third parameter, value, to lookup_allowed. If you are using that version, you can define lookup_allowed like this:

def lookup_allowed(self, key, value):
    if key in ('team__season__season_start_date__year', 'team__sport'):
        return True
    return super(PlayerYearAdmin, self).lookup_allowed(key, value)