From 559639eb632580cfc21ad6a61e5679fa7cb0c269 Mon Sep 17 00:00:00 2001 From: Alexey Bezhan Date: Tue, 21 Nov 2017 14:37:26 +0000 Subject: [PATCH] Verify that attribute exists on *History model when versioning objects When createing a history instance of the updated object `create_history` sets attributes using `setattr`. Since SQLAlchemy model instances are Python objects they don't prevent new attributes being created by setattr, which means that if history models are missing some of the columns the attributes will still be assigned, but their values will not be persisted by SQLAlchemy since database columns for them do not exist. To avoid this, we check that the attribute is defined on the `history_cls` and raise an error if it isn't. --- app/history_meta.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/history_meta.py b/app/history_meta.py index c89fe06ca..ff44255f9 100644 --- a/app/history_meta.py +++ b/app/history_meta.py @@ -219,6 +219,8 @@ def create_history(obj, history_cls=None): data['created_at'] = obj.created_at for key, value in data.items(): + if not hasattr(history_cls, key): + raise AttributeError("{} has no attribute '{}'".format(history_cls.__name__, key)) setattr(history, key, value) return history