Repository: django/django
File: django/contrib/auth/management/__init__.py (Python)

Code before:
        .filter(
            content_type__in=set(ctypes.values()),
        )
        .values_list("content_type", "codename")
    )

    perms = []
    for model in models:
        ctype = ctypes[model]
        for codename, name in _get_all_permissions(model._meta):
            if (ctype.pk, codename) not in all_perms:
                permission = Permission()
                permission._state.db = using
                permission.codename = codename
                permission.name = name
                permission.content_type = ctype
                perms.append(permission)

    Permission.objects.using(using).bulk_create(perms)
    if verbosity >= 2:
        for perm in perms:
            print("Adding permission '%s'" % perm)


def _get_permission_metadata(apps, app_label, model_name):
    Permission = apps.get_model("auth", "Permission")
    try:
        model = apps.get_model(app_label, model_name)
    except LookupError:
        return (
            Permission._meta.default_permissions,
            model_name.replace("_", " "),
        )
    return (
        model._meta.default_permissions,
        model._meta.verbose_name_raw,
    )


def rename_permissions_after_model_rename(
    app_config,
    verbosity=2,
    plan=None,
    using=DEFAULT_DB_ALIAS,
    apps=global_apps,
    **kwargs,
):
    if not app_config.models_module:
        return

    # This handler is connected to the global post_migrate signal, which is

Review comment (security):
We should get the default permissions defined on the model being renamed, not the Permission model itself.

Code after:
        .filter(
            content_type__in=set(ctypes.values()),
        )
        .values_list("content_type", "codename")
    )

    perms = []
    for model in models:
        ctype = ctypes[model]
        for codename, name in _get_all_permissions(model._meta):
            if (ctype.pk, codename) not in all_perms:
                permission = Permission()
                permission._state.db = using
                permission.codename = codename
                permission.name = name
                permission.content_type = ctype
                perms.append(permission)

    Permission.objects.using(using).bulk_create(perms)
    if verbosity >= 2:
        for perm in perms:
            print("Adding permission '%s'" % perm)


def _get_permission_metadata(apps, app_label, model_name):
    try:
        model = apps.get_model(app_label, model_name)
    except LookupError:
        # Model does not exist in this migration state, e.g. zero.
        Permission = apps.get_model("auth", "Permission")
        return Permission._meta.default_permissions, model_name
    return (
        model._meta.default_permissions,
        model._meta.verbose_name_raw,
    )


def rename_permissions_after_model_rename(
    app_config,
    verbosity=2,
    plan=None,
    using=DEFAULT_DB_ALIAS,
    apps=global_apps,
    stdout=sys.stdout,
    **kwargs,
):
    if not app_config.models_module:
        return

    # This handler is connected to the global post_migrate signal, which is
    # emitted for *all* apps — including test configurations where