-
Notifications
You must be signed in to change notification settings - Fork 170
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[fix] Fixed REST API can creates device configs inadvertently #699 #759
Conversation
be422c0
to
4cb70f9
Compare
@@ -149,6 +151,16 @@ def _create_config(self, device, config_data): | |||
raise serializers.ValidationError({'config': error.messages}) | |||
|
|||
def _update_config(self, device, config_data): | |||
if ( | |||
config_data.get('backend') == app_settings.BACKENDS[0][0] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this should compare to the default value of the Config.backend
field, which if I remember correctly can be modified via OPENWISP_CONTROLLER_DEFAULT_BACKEND
.
config_data.get('backend') == app_settings.BACKENDS[0][0] | ||
and not config_data.get('templates') | ||
and not config_data.get('context') | ||
and not config_data.get('config') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you get the default values from the serializer fields and compare each property to the corresponding serializer field default? Such a solution would be more robust to future changes, I doubt anyone changing the default values (if ever needed, but we never know) of the serializer or model will remember to change this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The ModelSerializer defers enforcing defaults to the model
encode/django-rest-framework#2683
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The Browsable API is not using the default values defined in serializer fields when rendering form for Device object that does not have a Config:
The context
and config
field values are set to null
instead of {}
. When form with such values is saved, then serializer parses the data to
{
'backend': 'netjsonconfig.OpenWrt',
'config': None,
'context': None,
'templates': []
}
Which is different from the default values defined for the field:
{
'backend': 'netjsonconfig.OpenWrt',
'config': {},
'context': {},
'templates': []
}
I have enquired about this on DRF's mailing list.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
no problem let's use the model then
4cb70f9
to
e09895d
Compare
Fixes #699