Fixed #19354 -- Do not assume usermodel.pk == usermodel.id

Thanks markteisman at hotmail.com for the report.

django/contrib/admin/options.py

@@ -552,7 +552,7 @@ class ModelAdmin(BaseModelAdmin):
         """
         from django.contrib.admin.models import LogEntry, DELETION
         LogEntry.objects.log_action(
-            user_id         = request.user.id,
+            user_id         = request.user.pk,
             content_type_id = ContentType.objects.get_for_model(self.model).pk,
             object_id       = object.pk,
             object_repr     = object_repr,

django/contrib/auth/__init__.py

@@ -84,14 +84,14 @@ def login(request, user):
         user = request.user
     # TODO: It would be nice to support different login methods, like signed cookies.
     if SESSION_KEY in request.session:
-        if request.session[SESSION_KEY] != user.id:
+        if request.session[SESSION_KEY] != user.pk:
             # To avoid reusing another user's session, create a new, empty
             # session if the existing session corresponds to a different
             # authenticated user.
             request.session.flush()
     else:
         request.session.cycle_key()
-    request.session[SESSION_KEY] = user.id
+    request.session[SESSION_KEY] = user.pk
     request.session[BACKEND_SESSION_KEY] = user.backend
     if hasattr(request, 'user'):
         request.user = user

django/contrib/auth/forms.py

@@ -241,7 +241,7 @@ class PasswordResetForm(forms.Form):
                 'email': user.email,
                 'domain': domain,
                 'site_name': site_name,
-                'uid': int_to_base36(user.id),
+                'uid': int_to_base36(user.pk),
                 'user': user,
                 'token': token_generator.make_token(user),
                 'protocol': use_https and 'https' or 'http',

django/contrib/auth/tests/templates/context_processors/auth_attrs_user.html

@@ -1,4 +1,4 @@
 unicode: {{ user }}
-id: {{ user.id }}
+id: {{ user.pk }}
 username: {{ user.username }}
 url: {% url 'userpage' user %}

django/contrib/auth/tokens.py

@@ -58,7 +58,7 @@ class PasswordResetTokenGenerator(object):
         # Ensure results are consistent across DB backends
         login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None)
 
-        value = (six.text_type(user.id) + user.password +
+        value = (six.text_type(user.pk) + user.password +
                 six.text_type(login_timestamp) + six.text_type(timestamp))
         hash = salted_hmac(key_salt, value).hexdigest()[::2]
         return "%s-%s" % (ts_b36, hash)

django/contrib/auth/views.py

@@ -206,7 +206,7 @@ def password_reset_confirm(request, uidb36=None, token=None,
         post_reset_redirect = reverse('django.contrib.auth.views.password_reset_complete')
     try:
         uid_int = base36_to_int(uidb36)
-        user = UserModel.objects.get(id=uid_int)
+        user = UserModel.objects.get(pk=uid_int)
     except (ValueError, OverflowError, UserModel.DoesNotExist):
         user = None
 

docs/ref/templates/builtins.txt

@@ -618,7 +618,7 @@ Output the contents of the block if the two arguments equal each other.
 
 Example::
 
-    {% ifequal user.id comment.user_id %}
+    {% ifequal user.pk comment.user_id %}
         ...
     {% endifequal %}
 

tests/regressiontests/model_formsets_regress/tests.py

@@ -351,7 +351,7 @@ class FormfieldShouldDeleteFormTests(TestCase):
 
         def should_delete(self):
             """ delete form if odd PK """
-            return self.instance.id % 2 != 0
+            return self.instance.pk % 2 != 0
 
     NormalFormset = modelformset_factory(User, form=CustomDeleteUserForm, can_delete=True)
     DeleteFormset = modelformset_factory(User, form=CustomDeleteUserForm, formset=BaseCustomDeleteModelFormSet)
@@ -392,7 +392,7 @@ class FormfieldShouldDeleteFormTests(TestCase):
         data = dict(self.data)
         data['form-INITIAL_FORMS'] = 4
         data.update(dict(
-            ('form-%d-id' % i, user.id)
+            ('form-%d-id' % i, user.pk)
             for i,user in enumerate(User.objects.all())
         ))
         formset = self.NormalFormset(data, queryset=User.objects.all())
@@ -409,7 +409,7 @@ class FormfieldShouldDeleteFormTests(TestCase):
         data = dict(self.data)
         data['form-INITIAL_FORMS'] = 4
         data.update(dict(
-            ('form-%d-id' % i, user.id)
+            ('form-%d-id' % i, user.pk)
             for i,user in enumerate(User.objects.all())
         ))
         data.update(self.delete_all_ids)
@@ -428,7 +428,7 @@ class FormfieldShouldDeleteFormTests(TestCase):
         data = dict(self.data)
         data['form-INITIAL_FORMS'] = 4
         data.update(dict(
-            ('form-%d-id' % i, user.id)
+            ('form-%d-id' % i, user.pk)
             for i,user in enumerate(User.objects.all())
         ))
         data.update(self.delete_all_ids)
@@ -440,5 +440,5 @@ class FormfieldShouldDeleteFormTests(TestCase):
         self.assertEqual(len(User.objects.all()), 2)
 
         # verify no "odd" PKs left
-        odd_ids = [user.id for user in User.objects.all() if user.id % 2]
+        odd_ids = [user.pk for user in User.objects.all() if user.pk % 2]
         self.assertEqual(len(odd_ids), 0)

tests/regressiontests/transactions_regress/tests.py

@@ -140,7 +140,7 @@ class TestTransactionClosing(TransactionTestCase):
             "Create a user in a transaction"
             user = User.objects.create_user(username='system', password='iamr00t', email='root@SITENAME.com')
             # Redundant, just makes sure the user id was read back from DB
-            Mod.objects.create(fld=user.id)
+            Mod.objects.create(fld=user.pk)
 
         # Create a user
         create_system_user()