ModelMultipleChoiceField does not properly check if value is valid
|Reported by:||mattias.lindvall@…||Owned by:||nip3o|
|Has patch:||yes||Needs documentation:||no|
|Needs tests:||no||Patch needs improvement:||no|
ModelMultipleChoiceField does try to check if value is valid by doing a query here: https://github.com/django/django/blob/stable/1.6.x/django/forms/models.py#L1185
However, it only cathes ValueError, assuming that filter() is capable of even using the value.
If the value is a weird data type like list or dict, the call to filter throws TypeError.
ModelMultipleChoiceField.clean should catch TypeError, in addition to ValueError, on line 1187.
Here is gist with a complete minimal app that demonstrates how this can happen: https://gist.github.com/thnee/8e7c6b22f350582efe57/
Specifically the file: 4. views.py.
It is tested with 1.6.5, using 100% default settings in a clean test project.
Change History (9)
comment:1 Changed 2 years ago by maxocub
- Cc maxime.turcotte@… added
- Needs documentation unset
- Needs tests unset
- Patch needs improvement unset
comment:7 Changed 2 years ago by nip3o
- Owner changed from nobody to nip3o
- Status changed from new to assigned