Commit a8c53041 authored by Karl Hobley's avatar Karl Hobley Committed by Tim Graham
Browse files

[1.8.x] Fixed #24495 -- Allowed unsaved model instance assignment check to be bypassed. 

Backport of 81e1a35c from master
parent 247251c2

django/contrib/contenttypes/fields.py

+3 −1
Original line number Diff line number Diff line
@@ -32,6 +32,8 @@ class GenericForeignKey(object): 
    one_to_one = False

    related_model = None



    allow_unsaved_instance_assignment = False



    def __init__(self, ct_field="content_type", fk_field="object_id", for_concrete_model=True):

        self.ct_field = ct_field

        self.fk_field = fk_field
@@ -241,7 +243,7 @@ class GenericForeignKey(object): 
        if value is not None:

            ct = self.get_content_type(obj=value)

            fk = value._get_pk_val()

            if fk is None:

            if not self.allow_unsaved_instance_assignment and fk is None:

                raise ValueError(

                    'Cannot assign "%r": "%s" instance isn\'t saved in the database.' %

                    (value, value._meta.object_name)

django/db/models/fields/related.py

+3 −2
Original line number Diff line number Diff line
@@ -498,7 +498,7 @@ class SingleRelatedObjectDescriptor(object): 
                    raise ValueError('Cannot assign "%r": the current database router prevents this relation.' % value)



        related_pk = tuple(getattr(instance, field.attname) for field in self.related.field.foreign_related_fields)

        if None in related_pk:

        if not self.related.field.allow_unsaved_instance_assignment and None in related_pk:

            raise ValueError(

                'Cannot assign "%r": "%s" instance isn\'t saved in the database.' %

                (value, instance._meta.object_name)
@@ -662,7 +662,7 @@ class ReverseSingleRelatedObjectDescriptor(object): 
        else:

            for lh_field, rh_field in self.field.related_fields:

                pk = value._get_pk_val()

                if pk is None:

                if not self.field.allow_unsaved_instance_assignment and pk is None:

                    raise ValueError(

                        'Cannot assign "%r": "%s" instance isn\'t saved in the database.' %

                        (value, self.field.rel.to._meta.object_name)
@@ -1475,6 +1475,7 @@ class ForeignObject(RelatedField): 
    one_to_many = False

    one_to_one = False



    allow_unsaved_instance_assignment = False

    requires_unique_target = True

    related_accessor_class = ForeignRelatedObjectsDescriptor

docs/ref/contrib/contenttypes.txt

+7 −0
Original line number Diff line number Diff line
@@ -299,6 +299,13 @@ model: 
       is ``True``. This mirrors the ``for_concrete_model`` argument to

       :meth:`~django.contrib.contenttypes.models.ContentTypeManager.get_for_model`.



    .. attribute:: GenericForeignKey.allow_unsaved_instance_assignment



        .. versionadded:: 1.8



        Works analogously to :attr:`ForeignKey.allow_unsaved_instance_assignment

        <django.db.models.ForeignKey.allow_unsaved_instance_assignment>`.



    .. deprecated:: 1.7



        This class used to be defined in ``django.contrib.contenttypes.generic``.

docs/ref/models/fields.txt

+31 −1
Original line number Diff line number Diff line
@@ -1330,6 +1330,30 @@ The possible values for :attr:`~ForeignKey.on_delete` are found in 


    If in doubt, leave it to its default of ``True``.



.. attribute:: ForeignKey.allow_unsaved_instance_assignment



    .. versionadded:: 1.8



        This flag was added for backwards compatibility as older versions of

        Django always allowed assigning unsaved model instances.



    Django prevents unsaved model instances from being assigned to a

    ``ForeignKey`` field to prevent accidental data loss (unsaved foreign keys

    are silently ignored when saving a model instance).



    If you require allowing the assignment of unsaved instances and aren't

    concerned about the data loss possibility (e.g. you never save the objects

    to the database), you can disable this check by creating a subclass of the

    field class and setting its ``allow_unsaved_instance_assignment`` attribute

    to ``True``. For example::



        class UnsavedForeignKey(models.ForeignKey):

            # A ForeignKey which can point to an unsaved object

            allow_unsaved_instance_assignment = True



        class Book(models.Model):

            author = UnsavedForeignKey(Author)



.. _ref-manytomany:



``ManyToManyField``
@@ -1532,6 +1556,12 @@ that control how the relationship functions. 


    If in doubt, leave it to its default of ``True``.



.. attribute:: ManyToManyField.allow_unsaved_instance_assignment



    .. versionadded:: 1.8



    Works analogously to :attr:`ForeignKey.allow_unsaved_instance_assignment`.



:class:`ManyToManyField` does not support :attr:`~Field.validators`.



:attr:`~Field.null` has no effect since there is no way to require a

docs/releases/1.8.txt

+6 −0
Original line number Diff line number Diff line
@@ -712,6 +712,12 @@ Now, an error will be raised to prevent data loss:: 
    ...

    ValueError: Cannot assign "<Author: John>": "Author" instance isn't saved in the database.



If you require allowing the assignment of unsaved instances (the old behavior)

and aren't concerned about the data loss possibility (e.g. you never save the

objects to the database), you can disable this check by using the

:attr:`~django.db.models.ForeignKey.allow_unsaved_instance_assignment`

attribute.



Management commands that only accept positional arguments

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~