#12203: ManyToManyField with through model can't be used in admin
-------------------------------------+-------------------------------------
     Reporter:  David Gouldin        |                    Owner:  nobody
         Type:  Bug                  |                   Status:  new
    Component:  contrib.admin        |                  Version:  master
     Severity:  Normal               |               Resolution:
     Keywords:  M2M, admin,          |             Triage Stage:  Accepted
  through, through_fields            |
    Has patch:  1                    |      Needs documentation:  0
  Needs tests:  0                    |  Patch needs improvement:  1
Easy pickings:  0                    |                    UI/UX:  0
-------------------------------------+-------------------------------------

Comment (by Dennis):

 Replying to [comment:22 Dmitry Mugtasimov]:

 The trick of setting `JobTitleExperienceThrough._meta.auto_created = True`
 in `formfield_for_manytomany` does indeed enable the
 `ModelMultipleChoiceField` on the admin page without causing migration
 issues (as far as I can see).

 However, there is a dangerous side-effect of using this, in case you have
 other models with a "cascading" relation directly to your explicit
 through-model, e.g. `models.ForeignKey(to=JobTitleExperienceThrough,
 on_delete=models.CASCADE)`:

 If the initial queryset for the m2m field `JobTitle.experiences` is
 filtered (e.g. as in the docs
 
[https://docs.djangoproject.com/en/3.0/ref/contrib/admin/#django.contrib.admin.ModelAdmin.formfield_for_manytomany]),
 and, for whatever reason, the filter excludes some `Experience` objects
 that have previously been assigned, then the corresponding records from
 `JobTitleExperienceThrough` will be silently deleted, including any
 records for other models pointing to them.

 This means there is a serious potential for "silent" data loss.

 This is because the many-to-many relation will now be updated using
 `ManyRelatedManager.set()` (via `ModelAdmin.save_related()` ->
 `form.save_m2m()` -> `BaseModelForm._save_m2m()` ->
 `ManyToManyField.save_form_data()`).

 Silent deletion could be prevented by setting `on_delete=models.PROTECT`
 on any relation to the explicit through-model, but then you would first
 have to be aware of the necessity.

 When using a "real" auto-created `through` table (i.e. an implicit one)
 the issue does not arise, because there is no way to set a `ForeignKey` to
 the implicit `through`, as far as I know.

 When using an inline for `JobTitleExperienceThrough`, this issue does not
 occur.

-- 
Ticket URL: <https://code.djangoproject.com/ticket/12203#comment:23>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/066.794eb1972440844545cc2226e74dc6c6%40djangoproject.com.

Reply via email to