当您从 Django 管理员 class 中排除字段时，这是否也会阻止在 POST 中设置该字段？

Question

Say I have a model admin:

class Customer(Model):
    name = CharField(max_length=255)
    secret = CharField(max_length=255, blank=True)


@register(Customer)
class CustomerAdmin(ModelAdmin):
    list_display = ['name']
    exclude = ['secret']

The secret field is not going to appear in the admin. But if I programmatically create a POST with the secret field in, will Django prevent it from being set on the model? So is there any security risk in having an admin class for a model which has excluded fields that should not be written to from a web client?

Answer 1

Answer is that this should be fine and using exclude should be enough to prevent the field being set by a malicious POST.

The reason lies in construct_instance() (django 3.2) , which is used to populate a new or existing instance (the instance argument) with data from the POST (in the fields argument):

def construct_instance(form, instance, fields=None, exclude=None):
    ...
    for f in opts.fields:
        ...
        if exclude and f.name in exclude:
            continue
        ...
        else:
            f.save_form_data(instance, cleaned_data[f.name])

Which gets called as:

class BaseModelForm(BaseForm):
    ...
    def _post_clean(self):
        opts = self._meta
        ...
        try:
            self.instance = construct_instance(self, self.instance, opts.fields, opts.exclude)
        except ValidationError as e:
            ...

And the exclude is populated by the django.contrib.admin.options.ModelAdmin :

class ModelAdmin(BaseModelAdmin):
    ...
    def get_exclude(self, request, obj=None):
        return self.exclude

    ...

    def get_form(self, request, obj=None, change=False, **kwargs):
        ...
        excluded = self.get_exclude(request, obj)
        exclude = [] if excluded is None else list(excluded)
        ...
        defaults = {
            ...
            'exclude': exclude,
            ...
        }
        ...
        try:
            return modelform_factory(self.model, **defaults)
        except FieldError as e:
            ...

And modelform_factory just passes that through to the form's options.