Partial update skip required field validation

[Geniushjs]

It's caused by:

https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/fields.py#L178-L179

I am not sure why the author need to set required=False then doing partial update?

[Geniushjs]

This would cause security issue, user and partial update some required field to empty.

[kevin-brown]

Partial updates are designed to allow only part of the data, whether it is required or not, be to used to update a model/object. If the fields remained as required, they would cause validation errors when they were not included in the request body, as the serializer would still be expecting them to be passed in.

[Geniushjs]

It doesn't make sense as this let user skip the validation of some required fields.
For example, if a "name" field in user's profile is required non-empty, user can register with a real name first and then update it to empty string. this would cause something strange like : "" sent you a message ..

[Geniushjs]

I think this is a bug implementation, and need to be fixed. just let required=False in partial update is a kind of hacky way to implement partial update and caused security issues like I described.

[Geniushjs]

The correct implementation should be:

1. remove the two lines in https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/fields.py#L178-L179
2. change "if self.required" to "if self.required and not self.partial" in https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/fields.py#L364

[tomchristie]

Suggesting we defer anything on this until after the 3.0 serializer redesign.

[dmk23]

So what is the proper way to do this in 3.0?

[tomchristie]

@dmk23 - Looking through the thread it's not clear enough what the question is, or if there's any remaining issue. I'd suggest you start out asking your question on the discussion group, and consider moving it over here if you believe that it's an actionable bug.

[dmk23]

Never mind - solved the issue by selectively applying required=False, fully disabling validators on certain fields with validators=[] and replacing them with our custom validation logic ...