Fix issue #5258

[elmccarthy]

Description

Sanitize serializer.data to remove hidden fields before rendering template
JSON instance to raw data form.

refs #5258
closes #5258

[lovelydinosaur]

Thanks @elmccarthy - seems pretty clear-cut. 😄

[seav]

I think this PR breaks serializers from the djangorestframework-gis add-on. This add-on serializes model objects into a GeoJSON-compatible dict with id, type, geometry, and properties fields. So this PR tries to look for these fields in the serializer class and will most probably result into a KeyError. This is obviously not DRF's fault but I think the removing of hidden fields should happen earlier, when the model object is being serialized, and not after the fact.

[carltongibson]

@seav First step here is a test showing the kind of call that is failing but shouldn't. From there we can think about adjustments.

[jklaiho]

Seconding the djangorestframework-gis issue, ran into this today. Reported at openwisp/django-rest-framework-gis#145

[rpkilby]

Hi @jklaiho and @seav, I'm going to second @carltongibson here. It would be very helpful to have a minimal test case or a bit of sample code that demonstrates the issue.

[jklaiho]

@carltongibson @rpkilby Here's a minimal Django project I cooked up to demonstrate this:

https://github.com/jklaiho/drf_gis_bug

[rpkilby]

Thanks @jklaiho, that and #5498 clarified the problem.

To recap, django-rest-framework-gis, does not use HiddenFields. The problem is that the HiddenField filtering in the browsable API assumes that the keys in the serializer.data will correspond to fields on the serializer. This assumption is incorrect and breaks the browsable API in these cases.