Omitted fields still appears to allow saving omitted field on the model
Sbacon017 opened this issue · 0 comments
Sbacon017 commented
When passing omitted fields to the serializer in a views' get_serializer
method, it still seems to be possible to save/update said fields, even though they're not returned in the Response.
For example:
def get_serializer(self, *args, **kwargs):
serializer_class = self.get_serializer_class()
kwargs.setdefault('context', self.get_serializer_context())
kwargs.update({'omit': 'example_field'})
return serializer_class(*args, **kwargs)
Will not return example_field
in the response, however any value passed into a PUT
or PATCH
request for that field will still be saved on the model.
Fields don't seem to be omitted until to_representation
is called, but the lateness of that call means that the serializer still contains these fields up until the response is prepared. Is this the expected behavior? It seems contrary to what I would expect.