HiddenField shows up in the HTML form of the web browsable API page

[lgp171188]

I have a model with a foreign key reference to the User model called 'user'. In my serializer class, which is a sub-class of ModelSerializer, I have overridden the default field created by ModelSerializer and set it to:

user = serializers.HiddenField(default=serializers.CurrentUserDefault())

When displaying the fields in the API response, this field is indeed hidden, but in the web browsable API page, the HTML form shows a textbox for the user field which is supposed to be hidden.

Here is my serializer definition:

class CategorySerializer(serializers.ModelSerializer):
    user = serializers.HiddenField(default=serializers.CurrentUserDefault())
    class Meta:
        model = Category
        fields = ('name', 'description', 'created', 'modified','user')

Please see the screenshot illustrating the HTML form with an input for the hidden field.

I am totally new to Django REST Framework, so sorry if I haven't RTFM and raised this issue.

[lgp171188]

I am using version 3.0.3

[jpadilla]

Not sure if intentional, but HiddenFields aren't handled in HTMLFormRenderer.

[tomchristie]

Yup looks valid to me.

[tomchristie]

Thanks for raising this.

[jpadilla]

@tomchristie submitting a fix...

[lgp171188]

This could be misleading because I tried to fill in the username of some other user in the form field to see if I could create a category owned by that user. But it created with the user as the currently logged in user.

[tomchristie]

This could be misleading

Agreed - it is misleading yup. We def shouldn't be displaying the field - it won't be being used.

[rubendura]

Is this really fixed? I have updated DRF to 3.0.4 but my hidden fields keep appearing as before for some reason. I've already checked that the changes from the commit closing this issue have been applied, so I have no idea what's wrong with my environment.

[lgp171188]

Yes, I can confirm that this fix does not work.

[jpadilla]

Closed via #2580