id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
17137	ModelForm is_valid() accepts options outside choices	hayrynen@…	Dan Poirier	"If form is made using `ModelForm` and choices of `ManyToMany` field are limited like this:

{{{
# models.py

class Product(models.Model):
   name = models.CharField(max_length=60, verbose_name=""Name"")
   visibility = models.ManyToManyField(Group, verbose_name=""Groups"")

# views.py

class ProductForm(forms.ModelForm):
   def __init__(self, group_choices, *args, **kwargs):
       super(ProductForm, self).__init__(*args, **kwargs)
       self.fields['visibility'].choices = group_choices
   class Meta:
       model = Product

@login_required
def products_view(request):
   userprofile = UserProfile.objects.get(user = request.user)
   groups = [ (i.id, i.group) for i in Membership.objects.filter(userprofile=userprofile) ]

   if request.method == ""POST"":
       form = ProductForm(groups, request.POST)
       if form.is_valid():
           .. do stuff with visibility trusting form.is_valid()
}}}

`is_valid()` allows values for `ManyToMany` selections outside what is specified in the form as long as there exists corresponding ID in the database. Obviously the submitted form needs to be modified outside standard browser UI.

`is_valid()` should compare selections against .choices, not against what exists in the database.

"	Bug	closed	Forms	1.3	Normal	invalid			Accepted	0	0	0	0	0	0