🐛 AttributeError: 'ModelSelect2MultipleWidget' object has no attribute 'uuid' in v8.4.1

[nizarcan]

Bug Description

After upgrading to django-select2 v8.4.1, ModelSelect2MultipleWidget and other HeavySelect2Mixin subclasses throw AttributeError: 'ModelSelect2MultipleWidget' object has no attribute 'uuid' when rendering. This appears to be a regression introduced by the security fix in v8.4.1

The issue occurs because uuid generation was moved from __init__ to build_attrs in v8.4.1, but _get_cache_key is called earlier in the render flow (render() → set_to_cache() → _get_cache_key())

Steps to Reproduce

1- Install django-select2 v8.4.1
2- Create any widget inheriting from ModelSelect2MultipleWidget or HeavySelect2Mixin
3- Try to render the widget in a form

Expected Behavior

Widget should render without errors, as it did in v8.4.0

[codingjoe]

Hi @nizarcan,

Thanks for reaching out. I am working on a bigger patch for the underlying issue.
However, since this 8.4.1 was a security release, I would fast-track patch for this issue.

Do you have a full stack trace for me?

Thanks
Johannes

[nizarcan]

Hey! Sure, here's the full stack trace:

  File "django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
  
  File "django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  
  File "newrelic/hooks/framework_django.py", line 523, in wrapper
    return wrapped(*args, **kwargs)
  
  File "django/contrib/admin/options.py", line 716, in wrapper
    return self.admin_site.admin_view(view)(*args, **kwargs)
  
  File "django/utils/decorators.py", line 188, in _view_wrapper
    result = _process_exception(request, e)
  
  File "django/utils/decorators.py", line 186, in _view_wrapper
    response = view_func(request, *args, **kwargs)
  
  File "django/views/decorators/cache.py", line 80, in _view_wrapper
    response = view_func(request, *args, **kwargs)
  
  File "django/contrib/admin/sites.py", line 240, in inner
    return view(request, *args, **kwargs)
  
  File "reversion/admin.py", line 239, in changelist_view
    return super().changelist_view(request, context)
  
  File "django/utils/decorators.py", line 48, in _wrapper
    return bound_method(*args, **kwargs)
  
  File "django/utils/decorators.py", line 188, in _view_wrapper
    result = _process_exception(request, e)
  
  File "django/utils/decorators.py", line 186, in _view_wrapper
    response = view_func(request, *args, **kwargs)
  
  File "django/contrib/admin/options.py", line 1987, in changelist_view
    cl = self.get_changelist_instance(request)
  
  File "django/contrib/admin/options.py", line 864, in get_changelist_instance
    return ChangeList(
  
  File "django/contrib/admin/views/main.py", line 144, in __init__
    self.queryset = self.get_queryset(request)
  
  File "django/contrib/admin/views/main.py", line 539, in get_queryset
    ) = self.get_filters(request)
  
  File "django/contrib/admin/views/main.py", line 200, in get_filters
    spec = list_filter(request, lookup_params, self.model, self.model_admin)
  
  File "django_select2_admin_filters/mixins.py", line 94, in __init__
    self.init_select2()
  
  File "django_select2_admin_filters/mixins.py", line 50, in init_select2
    select2.set_to_cache()
  
  File "django_select2/forms.py", line 407, in set_to_cache
    self._get_cache_key(),
  
  File "django_select2/forms.py", line 306, in _get_cache_key
    return f"{settings.SELECT2_CACHE_PREFIX}{self.uuid}"
    
AttributeError: 'CustomSelect2MultipleWidget' object has no attribute 'uuid'

and here's the django dependencies I have:

>>> pip list | grep django
arq-django-admin              0.3.4
django-admin-rangefilter      0.13.2
django-admirarchy             1.2.2
django-allauth                65.8.1
django-appconf                1.0.6
django-compositepk-model      1.0.3
django-debug-toolbar          5.2.0
django-environ                0.12.0
django-extensions             3.2.3
django-json-widget            2.0.1
django-jsonform               2.23.2
django-object-actions         5.0.0
django-postgresql-setrole     1.0.12
django-reversion              5.1.0
django-reversion-compare      0.18.1
django-rq                     3.0.0
django-select2                8.4.1
django-select2-admin-filters  0.1.4
django-stubs                  5.2.0
django-stubs-ext              5.2.0
pytest-django                 4.11.1

[codingjoe]

Hello again,

And thank you for sharing the trace. Sadly, the issue seems to be related to the usage of internal APIs in django-select2-admin-filters. I must strongly advise you to discontinue using this package, as it hasn't seen any updates in over 4 years. You may also try your luck reaching out to its maintainer. However, until then, I would advise you to drop it and apply the security patch.

I know this maybe wasn't the answer you are looking for. However, the package relies on the very security bug that we fixed.

Best
Joe