Why does ModelForm do validation and not Model

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|

Why does ModelForm do validation and not Model

Will Gordon
I can't seem to find a good reason for this. And I could foresee this preventing potential mistakes. I'm not proposing to actually change the implementation, I guess I'm just looking for the reason of it.

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/97ae2f12-bc27-403d-8b76-f456a63fc0d9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Aymeric Augustin
Hello Will,

It's mostly for performance reasons, since validation can be expensive. You can override save() to call full_clean() in a model if you'd like.

Cheers,

-- 
Aymeric.



On 16 Apr 2019, at 20:47, Will Gordon <[hidden email]> wrote:

I can't seem to find a good reason for this. And I could foresee this preventing potential mistakes. I'm not proposing to actually change the implementation, I guess I'm just looking for the reason of it.

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/97ae2f12-bc27-403d-8b76-f456a63fc0d9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/D7E2A8BE-C236-4000-8E05-A6D756AD4C46%40polytechnique.org.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Will Gordon
So the validation is cheaper when performed by ModelForm, as opposed to the Model?

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/8d929b8e-b0e9-4a88-b796-26f00266f729%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Tom Forbes

The idea is that you generally always have to do extensive validation when accepting user input through a form. These validations could require additional database queries or other somewhat expensive lookups (especially with validate unique).

However if you are loading data from a trusted source, e.g:

for row in your_csv_file:
    instance = Model(**row)
    instance.save()  

Then there is no need to call that potentially slow full_clean(). There is not much value in slowing down all .save()’s needlessly - the developer should know when it’s appropriate to run validations and can run full_clean() when needed.




On 16 April 2019 at 21:42:24, Will Gordon ([hidden email]) wrote:

So the validation is cheaper when performed by ModelForm, as opposed to the Model?
--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/8d929b8e-b0e9-4a88-b796-26f00266f729%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CAFNZOJMUPSptux9yeSVtcHLi2HR80YfzgXmhMqnWQ_eEMYqqdA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Will Gordon
Ahh, cool. That makes more sense. I worry that it still leaves open the potential of accidentally not validating something. It may make more sense to offer instance.save(validate=False) instead of relying on the developer to always know whether they can trust the input. But I agree that for historical reasons, I'm sure it's much more difficult to implement this now.

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/cd8ba920-f59d-4afc-afe7-7988fb3348a3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Curtis Maloney-2
In reply to this post by Aymeric Augustin
On 4/17/19 4:55 AM, Aymeric Augustin wrote:
> Hello Will,
>
> It's mostly for performance reasons, since validation can be expensive.

Really? My memory was that it was (a) backward compatibility [model
validation was added later], and (b) practicality [try catching
everywhere in your code you save a model, and enforce catching
validation exceptions there].

Models _support_ validation, but don't _enforce_ it.

--
Curtis

--
You received this message because you are subscribed to the Google Groups "Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/f162b3b7-3045-e1f2-e82e-e18fa6de49c5%40tinbrain.net.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Aymeric Augustin
Hi Curtis,

Le mer. 17 avr. 2019 à 22:32, Curtis Maloney <[hidden email]> a écrit :

> It's mostly for performance reasons, since validation can be expensive.

Really? My memory was that it was (a) backward compatibility [model
validation was added later], and (b) practicality [try catching
everywhere in your code you save a model, and enforce catching
validation exceptions there].

These arguments are absolutely valid.

I can't say for sure if some concerns ranked higher than others.
 
--
Aymeric.

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/CANE-7mXP3P%2BBeKnU4Mu8WuC3Gh9PWh-2GDaC7H0Kzc6%2BEtcexg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Václav Řehák
Dne čtvrtek 18. dubna 2019 10:56:55 UTC+2 Aymeric Augustin napsal(a):
Le mer. 17 avr. 2019 à 22:32, Curtis Maloney <<a href="javascript:" target="_blank" gdf-obfuscated-mailto="AXfoTwADBAAJ" rel="nofollow" onmousedown="this.href=&#39;javascript:&#39;;return true;" onclick="this.href=&#39;javascript:&#39;;return true;">cur...@...> a écrit :

> It's mostly for performance reasons, since validation can be expensive.

Really? My memory was that it was (a) backward compatibility [model
validation was added later], and (b) practicality [try catching
everywhere in your code you save a model, and enforce catching
validation exceptions there].

These arguments are absolutely valid.

I can't say for sure if some concerns ranked higher than others.

The question is if there is consensus that model validation should really be opt-in.

 As a veteran Django user, I am quite used to it but as I work on financial project (with strong requirements on data consistency) with a team of senior developers kind of new to Django I face a lot of confusion about why does Django let us save invalid data (actually last week I spent almost 3 days on fixes caused forgotten calls to full_clean and on data migration to clean up the mess). If it was possible, e.g. in settings, to force model validation in save(), it would help us a lot.

Vaclav

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/6c7fc8f6-1329-456a-985c-5f0771084b1f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

Tobias Kunze-2
On 19-04-18 05:07:53, Václav Řehák wrote:
>If it was possible, e.g. in settings, to force model
>validation in save(), it would help us a lot.

Would it help you even if this would only apply to actual `save()`
calls, no bulk creates, no bulk updates, and no modifications of
m2m relationships via add/remove? I'm not sure if "forced validation …
on some cases" wouldn't be even more confusing in those tricky cases.

Tobias

--
You received this message because you are subscribed to the Google Groups "Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/20190418152718.pvdhxgsyeudzrdls%40cordelia.localdomain.
For more options, visit https://groups.google.com/d/optout.

signature.asc (849 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Why does ModelForm do validation and not Model

René Fleschenberg
In reply to this post by Václav Řehák
Hi

On 4/18/19 2:07 PM, Václav Řehák wrote:
>  As a veteran Django user, I am quite used to it but as I work on
> financial project (with strong requirements on data consistency) with a
> team of senior developers kind of new to Django I face a lot of
> confusion about why does Django let us save invalid data (actually last
> week I spent almost 3 days on fixes caused forgotten calls to full_clean
> and on data migration to clean up the mess). If it was possible, e.g. in
> settings, to force model validation in save(), it would help us a lot.
You can make an abstract model with an overriden save() that calls
full_clean() and inherit all your models from it. However, remember that
this does not cover all database writes. For example, update() on a
queryset does not call save(). For this reason, I don't think it is a
good idea. It just gives developers a false sense of security. Instead,
make sure to validate all input at the application boundary (e.g. using
forms).

If data integrity is really important, also consider using
database-level constraints. This can be done using raw SQL from a
migration. In Django 2.2, there also is
https://docs.djangoproject.com/en/2.2/ref/models/constraints/.


--
René Fleschenberg

--
You received this message because you are subscribed to the Google Groups "Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Visit this group at https://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/8ce3915a-de41-8fee-c36e-078d003b1677%40fleschenberg.net.
For more options, visit https://groups.google.com/d/optout.