Ordering by excluded field not possible

[tadeck]

As far as I see, even if you explicitly mention in Resource's Meta some field that should allow ordering (by supplying it as element of the list in Meta.ordering property), you cannot actually sort by that field, if it is given within the Meta.excludes list of excluded fields.

The code responsible for such behaviour (and visible here) is here:

if not field_name in self.fields:
    # It's not a field we know about. Move along citizen.
    raise InvalidSortError("No matching '%s' field for ordering on." % field_name)

Is that intended behaviour? I would expect ability to sort by some field (by adding its name to ordering option), even if I do not want this field to be displayed in the output (which I currently fulfill by supplying its name into excludes option).

[dmacthedestroyer]

The implemented behavior seems the most reasonable to me... If you're excluding a field from being visible from the API, then from the perspective of the person consuming your API, it doesn't exist at all.

Do you have a particular scenario in which this behavior should be allowed?

[tolomea]

From a security point of view, the sorting leaks information about the
field, it is in effect showing the field in an obscured manner.

On Fri, Aug 10, 2012 at 6:10 AM, Daniel McDonald
notifications@github.comwrote:

The implemented behavior seems the most reasonable to me... If you're
excluding a field from being visible from the API, then from the
perspective of the person consuming your API, it doesn't exist at all.

Do you have a particular scenario in which this behavior should be allowed?

—
Reply to this email directly or view it on GitHubhttps://github.com/toastdriven/django-tastypie/issues/607#issuecomment-7634314.

[jiaaro]

I'm using tastypie on a site that gives user content a "popularity score". I want to allow sorting results by popularity without exposing the actual numerical scores.

Mainly because they're not useful for anything except sorting and only serve to make the api responses less understandable, but also because I don't want to make it too easy to figure out the popularity scoring in an attempt to game the system.