mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #24495 -- Allowed unsaved model instance assignment check to be bypassed.

Browse Source
This commit is contained in:
Karl Hobley
2015-03-16 19:28:53 +00:00
committed by Tim Graham
parent 02d78bb1a8
commit 81e1a35c36
10 changed files with 136 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
django/db/models/fields/related.py
View File

@@ -513,7 +513,7 @@ class SingleRelatedObjectDescriptor(object):
raise ValueError('Cannot assign "%r": the current database router prevents this relation.' % value)
related_pk = tuple(getattr(instance, field.attname) for field in self.related.field.foreign_related_fields)
if None in related_pk:
if not self.related.field.allow_unsaved_instance_assignment and None in related_pk:
raise ValueError(
'Cannot assign "%r": "%s" instance isn\'t saved in the database.' %
(value, instance._meta.object_name)
@@ -684,7 +684,7 @@ class ReverseSingleRelatedObjectDescriptor(object):
else:
for lh_field, rh_field in self.field.related_fields:
pk = value._get_pk_val()
if pk is None:
if not self.field.allow_unsaved_instance_assignment and pk is None:
raise ValueError(
'Cannot assign "%r": "%s" instance isn\'t saved in the database.' %
(value, self.field.rel.to._meta.object_name)
@@ -1534,6 +1534,7 @@ class ForeignObject(RelatedField):
one_to_many = False
one_to_one = False
allow_unsaved_instance_assignment = False
requires_unique_target = True
related_accessor_class = ForeignRelatedObjectsDescriptor
rel_class = ForeignObjectRel