Merge pull request #854 from ryankask/issue-775

All relations pointing to ManyToManyFields should default to read-only

1 files changed, 17 insertions, 0 deletions

diff --git a/rest_framework/serializers.py b/rest_framework/serializers.py
index 229b2cde..3087d4e6 100644
--- a/rest_framework/serializers.py
+++ b/rest_framework/serializers.py
@@ -591,11 +591,16 @@ class ModelSerializer(Serializer):
         forward_rels += [field for field in opts.many_to_many if field.serialize]
 
         for model_field in forward_rels:
+            has_user_through_model = False
+
             if model_field.rel:
                 to_many = isinstance(model_field,
                                      models.fields.related.ManyToManyField)
                 related_model = model_field.rel.to
 
+                if to_many and not model_field.rel.through._meta.auto_created:
+                    has_user_through_model = True
+
             if model_field.rel and nested:
                 if len(inspect.getargspec(self.get_nested_field).args) == 2:
                     warnings.warn(
@@ -624,6 +629,9 @@ class ModelSerializer(Serializer):
                 field = self.get_field(model_field)
 
             if field:
+                if has_user_through_model:
+                    field.read_only = True
+
                 ret[model_field.name] = field
 
         # Deal with reverse relationships
@@ -641,6 +649,12 @@ class ModelSerializer(Serializer):
                 continue
             related_model = relation.model
             to_many = relation.field.rel.multiple
+            has_user_through_model = False
+            is_m2m = isinstance(relation.field,
+                                models.fields.related.ManyToManyField)
+
+            if is_m2m and not relation.field.rel.through._meta.auto_created:
+                has_user_through_model = True
 
             if nested:
                 field = self.get_nested_field(None, related_model, to_many)
@@ -648,6 +662,9 @@ class ModelSerializer(Serializer):
                 field = self.get_related_field(None, related_model, to_many)
 
             if field:
+                if has_user_through_model:
+                    field.read_only = True
+
                 ret[accessor_name] = field
 
         # Add the `read_only` flag to any fields that have bee specified