Opened 6 years ago

Closed 6 years ago

Last modified 3 years ago

#10363 closed (fixed)

ModelForm excluded field can still be updated

Reported by: jgoldberg Owned by: nobody
Component: Forms Version: 1.0
Severity: Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

Example:

class Object(models.Model):
    field_a = models.CharField(max_length=255)
    field_b = models.CharField(max_length=255)

class ObjectForm(ModelForm):
    field_a = forms.CharField(max_length=255)

    class Meta:
        model = Object
        exclude = ['field_a']

When you initialize ObjectForm with POST data that includes the *form* field_a, doing a save(commit=False) will return an Object with field_a containing the value from the POST data. This doesn't seem like expected behavior: since field_a is listed in the exclude list, the data should only go into cleaned_data['field_a'], and not the object. An easy fix, of course, is to not name your form-specific fields with the same names as your model fields. However, there are cases where I want to use ModelForm, but for a couple fields I want to do manual manipulation of the form data before I update my model object.

Attachments (2)

10363.diff (1.6 KB) - added by k0001 6 years ago.
fix and tests
exclude-save.diff (2.0 KB) - added by Alex 6 years ago.

Download all attachments as: .zip

Change History (7)

comment:1 Changed 6 years ago by jacob

  • milestone set to 1.1
  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Triage Stage changed from Unreviewed to Accepted

Changed 6 years ago by k0001

fix and tests

comment:2 Changed 6 years ago by k0001

  • Has patch set

Changed 6 years ago by Alex

comment:3 Changed 6 years ago by Alex

  • Triage Stage changed from Accepted to Ready for checkin

comment:4 Changed 6 years ago by russellm

  • Resolution set to fixed
  • Status changed from new to closed

(In [10575]) Fixed #10363 -- Modified ModelForm? handling to ensure that excluded fields can't be saved onto the model. Thanks to jgoldberg for the report, an Alex Gaynor for the fix.

comment:5 Changed 3 years ago by jacob

  • milestone 1.1 deleted

Milestone 1.1 deleted

Note: See TracTickets for help on using tickets.
Back to Top