{"action":"created","issue":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3335","labels_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3335/labels{/name}","comments_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3335/comments","events_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3335/events","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3335","id":103335923,"number":3335,"title":"Creating a ModelSerializer without either the 'fields' attribute or the 'exclude' attribute should be prohibited","user":{"login":"ideallical","id":5603406,"avatar_url":"https://avatars.githubusercontent.com/u/5603406?v=3","gravatar_id":"","url":"https://api.github.com/users/ideallical","html_url":"https://github.com/ideallical","followers_url":"https://api.github.com/users/ideallical/followers","following_url":"https://api.github.com/users/ideallical/following{/other_user}","gists_url":"https://api.github.com/users/ideallical/gists{/gist_id}","starred_url":"https://api.github.com/users/ideallical/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ideallical/subscriptions","organizations_url":"https://api.github.com/users/ideallical/orgs","repos_url":"https://api.github.com/users/ideallical/repos","events_url":"https://api.github.com/users/ideallical/events{/privacy}","received_events_url":"https://api.github.com/users/ideallical/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/labels/Enhancement","name":"Enhancement","color":"009800"}],"state":"open","locked":false,"assignee":{"login":"jpadilla","id":83319,"avatar_url":"https://avatars.githubusercontent.com/u/83319?v=3","gravatar_id":"","url":"https://api.github.com/users/jpadilla","html_url":"https://github.com/jpadilla","followers_url":"https://api.github.com/users/jpadilla/followers","following_url":"https://api.github.com/users/jpadilla/following{/other_user}","gists_url":"https://api.github.com/users/jpadilla/gists{/gist_id}","starred_url":"https://api.github.com/users/jpadilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpadilla/subscriptions","organizations_url":"https://api.github.com/users/jpadilla/orgs","repos_url":"https://api.github.com/users/jpadilla/repos","events_url":"https://api.github.com/users/jpadilla/events{/privacy}","received_events_url":"https://api.github.com/users/jpadilla/received_events","type":"User","site_admin":false},"milestone":null,"comments":11,"created_at":"2015-08-26T18:28:13Z","updated_at":"2015-08-27T15:28:06Z","closed_at":null,"body":"Since Django 1.8 you can't use ModelForms without the **fields** or **exclude** fields attribute:\r\nhttps://docs.djangoproject.com/en/1.8/topics/forms/modelforms/#selecting-the-fields-to-use\r\n\r\nI think ModelSerializers should behave the same way because this will make DjangoRestFramework more secure for programming \"mistakes\", e.g. adding an admin changeable field on a model, later realizing that the field is now editable for the public because you didn't explicitly provided the fields.\r\n\r\nThis would be a backwards-incompatible update though.\r\n\r\nHere's the commit in Django:\r\nhttps://github.com/django/django/commit/ee4edb1eda2ac8f09eb298929282b44776930c89\r\n\r\nWhat do you think?"},"comment":{"url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/comments/135469283","html_url":"https://github.com/tomchristie/django-rest-framework/issues/3335#issuecomment-135469283","issue_url":"https://api.github.com/repos/tomchristie/django-rest-framework/issues/3335","id":135469283,"user":{"login":"jpadilla","id":83319,"avatar_url":"https://avatars.githubusercontent.com/u/83319?v=3","gravatar_id":"","url":"https://api.github.com/users/jpadilla","html_url":"https://github.com/jpadilla","followers_url":"https://api.github.com/users/jpadilla/followers","following_url":"https://api.github.com/users/jpadilla/following{/other_user}","gists_url":"https://api.github.com/users/jpadilla/gists{/gist_id}","starred_url":"https://api.github.com/users/jpadilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpadilla/subscriptions","organizations_url":"https://api.github.com/users/jpadilla/orgs","repos_url":"https://api.github.com/users/jpadilla/repos","events_url":"https://api.github.com/users/jpadilla/events{/privacy}","received_events_url":"https://api.github.com/users/jpadilla/received_events","type":"User","site_admin":false},"created_at":"2015-08-27T15:28:06Z","updated_at":"2015-08-27T15:28:06Z","body":"As far as I can see this behavior was introduced in [Django 1.6](https://github.com/django/django/blob/stable/1.6.x/django/forms/models.py#L269) and added a pending deprecation warning. [Django 1.7](https://github.com/django/django/blob/stable/1.7.x/django/forms/models.py#L271) still has a warning. [Django 1.8](https://github.com/django/django/blob/stable/1.8.x/django/forms/models.py#L271) raises `ImproperlyConfigured`.\r\n\r\nOriginal [discussion](https://groups.google.com/forum/#!topic/django-developers/io74RDWgiLw/discussion) on django-developers."}}