Propogate alters_data value to subclasses

[vinay karanam]

Current implementation to prevent data changes within templates relies on the attribute alters_data = True.

By default this is set for all Model, QuerySet and ModelForm methods that can alter data.

But if someone overrides these methods, they need to explicitly set this attribute again.
It is common to override save method and not set this attribute.

Even a lot of popular third-party packages end up making this mistake.

These classes need to make sure that the attribute value is set for their subclasses methods if not explicitly overwritten.

[Tim Graham]

​WIP PR

[Carlton Gibson]

After looking at the implementation on the PR, the proposed metaclass solution is too much to given the relatively small improvement over the current alters_data solution.

The remaining suggestion from #27638 was to use the system checks framework to warn users of a problem. That might be worth a go. It would be able to capture the most common cases on Model classes certainly. (Whether we want to add that isn't clear: in lots of cases save is overridden without setting alters_data — to make that an error might be more annoying than a benefit, but it could at least be silenced.)

[Shai Berger]

Reopening the ticket following a discussion on the security mailing list, which led to ​https://github.com/django/django/pull/16149

[Shai Berger]

(in the last review the PR still had a couple of minor issues, but I believe it is ready for a merger review)

[Mariusz Felisiak <felisiak.mariusz@…>]

In e20c9eb:

Fixed #27654 -- Propagated alters_data attribute to callables overridden in subclasses.

Thanks Shai Berger and Adam Johnson for reviews and the implementation
idea.

[Mariusz Felisiak <felisiak.mariusz@…>]

In e20c9eb:

Fixed #27654 -- Propagated alters_data attribute to callables overridden in subclasses.

Thanks Shai Berger and Adam Johnson for reviews and the implementation
idea.