From ba0aaccfd88bd91f427895ae36f760bb225cde67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=98=D0=B3=D0=BE=D1=80=D1=8C=20=D0=9D=D0=B0=D0=B4=D0=B5?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Mon, 8 Dec 2025 12:41:56 +0300 Subject: [PATCH] fix: prevent QueryDict conversion breaking form data for non-admin users Problem: Regular users couldn't create requests while admins could Root cause: to_internal_value() used dict(QueryDict) which converts all values to lists, breaking validation Solution: - For QueryDict: use _mutable flag to modify in-place - For regular dict: use dict() conversion as before - Avoids ['value'] instead of 'value' conversion This fixes 400 errors for non-admin users when creating requests with multipart/form-data. --- backend/api/v1/requests_app/serializers.py | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/backend/api/v1/requests_app/serializers.py b/backend/api/v1/requests_app/serializers.py index e23f7463..fd2d9bc2 100644 --- a/backend/api/v1/requests_app/serializers.py +++ b/backend/api/v1/requests_app/serializers.py @@ -265,11 +265,22 @@ class RequestWriteSerializer(serializers.ModelSerializer): dict[str, Any]: Преобразованные данные для дальнейшей валидации. """ if not self._is_power(): - # data может быть QueryDict — сделаем копию как обычный dict - data = dict(data) - data.pop("employee", None) - data.pop("status", None) - data.pop("approver", None) + # ВАЖНО: data может быть QueryDict из DRF + # dict(QueryDict) превращает все значения в списки! + # Используем _mutable для безопасного удаления полей + if hasattr(data, '_mutable'): + # Это QueryDict, делаем его mutable + data._mutable = True + data.pop("employee", None) + data.pop("status", None) + data.pop("approver", None) + data._mutable = False + else: + # Обычный dict + data = dict(data) + data.pop("employee", None) + data.pop("status", None) + data.pop("approver", None) return super().to_internal_value(data)