Fixed transaction handling for a number of operations on related objects.

Thanks Anssi and Aymeric for the reviews. Refs #21174.

django/contrib/contenttypes/fields.py

@@ -394,6 +394,9 @@ class ReverseGenericRelatedObjectsDescriptor(object):
 
     def __set__(self, instance, value):
         manager = self.__get__(instance)
+
+        db = router.db_for_write(manager.model, instance=manager.instance)
+        with transaction.atomic(using=db, savepoint=False):
             manager.clear()
             for obj in value:
                 manager.add(obj)
@@ -474,6 +477,8 @@ def create_generic_related_manager(superclass):
                     self.prefetch_cache_name)
 
         def add(self, *objs):
+            db = router.db_for_write(self.model, instance=self.instance)
+            with transaction.atomic(using=db, savepoint=False):
                 for obj in objs:
                     if not isinstance(obj, self.model):
                         raise TypeError("'%s' instance expected" % self.model._meta.object_name)
@@ -498,6 +503,8 @@ def create_generic_related_manager(superclass):
             db = router.db_for_write(self.model, instance=self.instance)
             queryset = queryset.using(db)
             if bulk:
+                # `QuerySet.delete()` creates its own atomic block which
+                # contains the `pre_delete` and `post_delete` signal handlers.
                 queryset.delete()
             else:
                 with transaction.atomic(using=db, savepoint=False):

django/db/models/fields/related.py

@@ -735,6 +735,7 @@ def create_foreign_related_manager(superclass, rel_field, rel_model):
                 db = router.db_for_write(self.model, instance=self.instance)
                 queryset = queryset.using(db)
                 if bulk:
+                    # `QuerySet.update()` is intrinsically atomic.
                     queryset.update(**{rel_field.name: None})
                 else:
                     with transaction.atomic(using=db, savepoint=False):
@@ -763,6 +764,9 @@ class ForeignRelatedObjectsDescriptor(object):
 
     def __set__(self, instance, value):
         manager = self.__get__(instance)
+
+        db = router.db_for_write(manager.model, instance=manager.instance)
+        with transaction.atomic(using=db, savepoint=False):
             # If the foreign key can support nulls, then completely clear the related set.
             # Otherwise, just move the named objects into the set.
             if self.related.field.null:
@@ -901,6 +905,9 @@ def create_many_related_manager(superclass, rel):
                     "Cannot use add() on a ManyToManyField which specifies an intermediary model. Use %s.%s's Manager instead." %
                     (opts.app_label, opts.object_name)
                 )
+
+            db = router.db_for_write(self.through, instance=self.instance)
+            with transaction.atomic(using=db, savepoint=False):
                 self._add_items(self.source_field_name, self.target_field_name, *objs)
 
                 # If this is a symmetrical m2m relation to self, add the mirror entry in the m2m table
@@ -920,7 +927,7 @@ def create_many_related_manager(superclass, rel):
 
         def clear(self):
             db = router.db_for_write(self.through, instance=self.instance)
-
+            with transaction.atomic(using=db, savepoint=False):
                 signals.m2m_changed.send(sender=self.through, action="pre_clear",
                     instance=self.instance, reverse=self.reverse,
                     model=self.model, pk_set=None, using=db)
@@ -990,20 +997,24 @@ def create_many_related_manager(superclass, rel):
                         )
                     else:
                         new_ids.add(obj)
+
                 db = router.db_for_write(self.through, instance=self.instance)
-                vals = self.through._default_manager.using(db).values_list(target_field_name, flat=True)
+                vals = (self.through._default_manager.using(db)
-                vals = vals.filter(**{
+                        .values_list(target_field_name, flat=True)
+                        .filter(**{
                             source_field_name: self.related_val[0],
                             '%s__in' % target_field_name: new_ids,
-                })
+                        }))
                 new_ids = new_ids - set(vals)
 
+                with transaction.atomic(using=db, savepoint=False):
                     if self.reverse or source_field_name == self.source_field_name:
                         # Don't send the signal when we are inserting the
                         # duplicate data row for symmetrical reverse entries.
                         signals.m2m_changed.send(sender=self.through, action='pre_add',
                             instance=self.instance, reverse=self.reverse,
                             model=self.model, pk_set=new_ids, using=db)
+
                     # Add the ones that aren't there already
                     self.through._default_manager.using(db).bulk_create([
                         self.through(**{
@@ -1037,7 +1048,7 @@ def create_many_related_manager(superclass, rel):
                     old_ids.add(obj)
 
             db = router.db_for_write(self.through, instance=self.instance)
-
+            with transaction.atomic(using=db, savepoint=False):
                 # Send a signal to the other end if need be.
                 signals.m2m_changed.send(sender=self.through, action="pre_remove",
                     instance=self.instance, reverse=self.reverse,
@@ -1103,6 +1114,9 @@ class ManyRelatedObjectsDescriptor(object):
             raise AttributeError("Cannot set values on a ManyToManyField which specifies an intermediary model. Use %s.%s's Manager instead." % (opts.app_label, opts.object_name))
 
         manager = self.__get__(instance)
+
+        db = router.db_for_write(manager.through, instance=manager.instance)
+        with transaction.atomic(using=db, savepoint=False):
             manager.clear()
             manager.add(*value)
 
@@ -1157,9 +1171,13 @@ class ReverseManyRelatedObjectsDescriptor(object):
             raise AttributeError("Cannot set values on a ManyToManyField which specifies an intermediary model.  Use %s.%s's Manager instead." % (opts.app_label, opts.object_name))
 
         manager = self.__get__(instance)
+
         # clear() can change expected output of 'value' queryset, we force evaluation
         # of queryset before clear; ticket #19816
         value = tuple(value)
+
+        db = router.db_for_write(manager.through, instance=manager.instance)
+        with transaction.atomic(using=db, savepoint=False):
             manager.clear()
             manager.add(*value)
 

docs/releases/1.8.txt

@@ -168,7 +168,19 @@ Backwards incompatible changes in 1.8
     deprecation timeline for a given feature, its removal may appear as a
     backwards incompatible change.
 
-...
+* Some operations on related objects such as
+  :meth:`~django.db.models.fields.related.RelatedManager.add()` or
+  :ref:`direct assignment<direct-assignment>` ran multiple data modifying
+  queries without wrapping them in transactions. To reduce the risk of data
+  corruption, all data modifying methods that affect multiple related objects
+  (i.e. ``add()``, ``remove()``, ``clear()``, and
+  :ref:`direct assignment<direct-assignment>`) now perform their data modifying
+  queries from within a transaction, provided your database supports
+  transactions.
+
+  This has one backwards incompatible side effect, signal handlers triggered
+  from these methods are now executed within the method's transaction and
+  any exception in a signal handler will prevent the whole operation.
 
 Miscellaneous
 ~~~~~~~~~~~~~

tests/many_to_many/tests.py

@@ -1,5 +1,6 @@
 from __future__ import unicode_literals
 
+from django.db import transaction
 from django.test import TestCase
 from django.utils import six
 
@@ -54,7 +55,9 @@ class ManyToManyTests(TestCase):
 
         # Adding an object of the wrong type raises TypeError
         with six.assertRaisesRegex(self, TypeError, "'Publication' instance expected, got <Article.*"):
+            with transaction.atomic():
                 a6.publications.add(a5)
+
         # Add a Publication directly via publications.add by using keyword arguments.
         a6.publications.create(title='Highlights for Adults')
         self.assertQuerysetEqual(a6.publications.all(),

tests/multiple_database/tests.py

@@ -295,18 +295,22 @@ class QueryTestCase(TestCase):
 
         # Add to an m2m with an object from a different database
         with self.assertRaises(ValueError):
+            with transaction.atomic(using='default'):
                 marty.book_set.add(dive)
 
         # Set a m2m with an object from a different database
         with self.assertRaises(ValueError):
+            with transaction.atomic(using='default'):
                 marty.book_set = [pro, dive]
 
         # Add to a reverse m2m with an object from a different database
         with self.assertRaises(ValueError):
+            with transaction.atomic(using='other'):
                 dive.authors.add(marty)
 
         # Set a reverse m2m with an object from a different database
         with self.assertRaises(ValueError):
+            with transaction.atomic(using='other'):
                 dive.authors = [mark, marty]
 
     def test_m2m_deletion(self):
@@ -762,6 +766,7 @@ class QueryTestCase(TestCase):
 
         # Add to a foreign key set with an object from a different database
         with self.assertRaises(ValueError):
+            with transaction.atomic(using='other'):
                 dive.reviews.add(review1)
 
         # BUT! if you assign a FK object when the base object hasn't