[1.9.x] Fixed #25693 -- Prevented data loss with Prefetch and ManyToManyField.

Thanks to Jamie Matthews for finding and explaining the bug.

Backport of 4608573788c04fc047da42b4b7b48fdee8136ad3 from master

5 files changed, 39 insertions, 0 deletions

diff --git a/django/db/models/query.py b/django/db/models/query.py
index b7d55b6a4b..63d3ea7530 100644
--- a/django/db/models/query.py
+++ b/django/db/models/query.py
@@ -1575,6 +1575,17 @@ def prefetch_one_level(instances, prefetcher, lookup, level):
         instance_attr_val = instance_attr(obj)
         vals = rel_obj_cache.get(instance_attr_val, [])
         to_attr, as_attr = lookup.get_current_to_attr(level)
+
+        # Check we are not shadowing a field on obj.
+        if as_attr:
+            try:
+                field = obj._meta.get_field(to_attr)
+            except exceptions.FieldDoesNotExist:
+                pass
+            else:
+                msg = 'to_attr={} conflicts with a field on the {} model.'
+                raise ValueError(msg.format(to_attr, field.model.__name__))
+
         if single:
             val = vals[0] if vals else None
             to_attr = to_attr if as_attr else cache_name
diff --git a/docs/releases/1.7.11.txt b/docs/releases/1.7.11.txt
new file mode 100644
index 0000000000..7c6153eab1
--- /dev/null
+++ b/docs/releases/1.7.11.txt
@@ -0,0 +1,13 @@
+===========================
+Django 1.7.11 release notes
+===========================
+
+*Under development*
+
+Django 1.7.11 fixes a data loss bug in 1.7.10.
+
+Bugfixes
+========
+
+* Fixed a data loss possibility with :class:`~django.db.models.Prefetch` if
+  ``to_attr`` is set to a ``ManyToManyField`` (:ticket:`25693`).
diff --git a/docs/releases/1.8.7.txt b/docs/releases/1.8.7.txt
index 78912d0f52..6fb45803ac 100644
--- a/docs/releases/1.8.7.txt
+++ b/docs/releases/1.8.7.txt
@@ -21,3 +21,6 @@ Bugfixes
 
 * Fixed a regression in 1.8.6 that caused an application with South migrations
   in the ``migrations`` directory to fail (:ticket:`25618`).
+
+* Fixed a data loss possibility with :class:`~django.db.models.Prefetch` if
+  ``to_attr`` is set to a ``ManyToManyField`` (:ticket:`25693`).
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index bd71d18092..2251a51ac6 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -46,6 +46,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.7.11
    1.7.10
    1.7.9
    1.7.8
diff --git a/tests/prefetch_related/tests.py b/tests/prefetch_related/tests.py
index 7aed238bc0..cd763bb950 100644
--- a/tests/prefetch_related/tests.py
+++ b/tests/prefetch_related/tests.py
@@ -223,6 +223,17 @@ class PrefetchRelatedTests(TestCase):
         self.assertIn('prefetch_related', str(cm.exception))
         self.assertIn("name", str(cm.exception))
 
+    def test_m2m_shadow(self):
+        msg = 'to_attr=books conflicts with a field on the Author model.'
+        poems = Book.objects.filter(title='Poems')
+        with self.assertRaisesMessage(ValueError, msg):
+            list(Author.objects.prefetch_related(
+                Prefetch('books', queryset=poems, to_attr='books'),
+            ))
+        # Without the ValueError, a book was deleted due to the implicit
+        # save of reverse relation assignment.
+        self.assertEqual(self.author1.books.count(), 2)
+
 
 class CustomPrefetchTests(TestCase):
     @classmethod