Excluding required fields in Query Parameter fields

[jaimeres]

If, when creating a record, I use the 'QueryParameterValidationFilter fields', the excluded fields are not validated. Consider the following example, where 'name' is not validated because it is not included in fields.

class Product(models.Model):
    name = models.CharField(max_length=100)
    field1 = models.CharField(max_length=100, blank=True)
    field2 = models.CharField(max_length=100, blank=True)

Post uri.fields[type]=field1,field2

[sliverc]

Thanks for the heads-up. A very good find.

Some clarification. The QueryParameterValidationFilter only validates the query parameters itself. It is allowed to use sparse fields with POST request as per spec. However, the SparseFieldsetsMixin which is in charge of interpreting the fields parameter drops the fields of the serializer when parsing and rendering. It should not do it when parsing which is a bug and leads to your explained behavior. It does not validate exclude fields, but it also drops that field from the input data altogether when saving it.

Looking at the code, the mixin should instead of overwriting __init__ overwrite _readable_fields property. A PR is welcome.

[sliverc]

As this is a bug, I have created an issue #1216, so hopefully someone can pick it up and implement it.