nautobot 2.4.9__py3-none-any.whl → 2.4.10__py3-none-any.whl

nautobot/core/api/parsers.py

@@ -136,6 +136,56 @@ class NautobotCSVParser(BaseParser):
 
         return data_without_missing_field_lookups_values
 
+    def _convert_m2m_dict_to_list_of_dicts(self, data, field):
+        """
+        Converts a nested dictionary into list of flat dictionaries for M2M serializer.
+
+        Args:
+            data (dict): Nested dictionary with comma-separated string values.
+            field (str): Field name used in error messages.
+
+        Returns:
+            list: List of dictionaries, each containing one set of related values.
+
+        Raises:
+            ParseError: If the number of comma-separated values is inconsistent
+                       across different keys.
+
+        Examples:
+            >>> data = {'manufacturer': {'name': 'Cisco,Cisco,Aruba'}, 'model': 'C9300,C9500,CX 6300'}
+            >>> field = "device_type"
+            >>> value = self.convert_m2m_dict_to_list_of_dicts(data, field)
+            >>> value
+            [
+                {'manufacturer': {'name': 'Cisco'},'model': 'C9300'},
+                {'manufacturer': {'name': 'Cisco'},'model': 'C9500'},
+                {'manufacturer': {'name': 'Aruba'},'model': 'CX 6300'}
+            ]
+        """
+
+        def flatten_dict(d, parent_key=""):
+            """Flatten nested dictionary with __ separated keys"""
+            items = []
+            for k, v in d.items():
+                new_key = f"{parent_key}__{k}" if parent_key else k
+                if isinstance(v, dict):
+                    items.extend(flatten_dict(v, new_key).items())
+                else:
+                    items.append((new_key, v.split(",")))
+            return dict(items)
+
+        flat_data = flatten_dict(data)
+
+        # Convert dictionary to list of dictionaries
+        values_count = {len(value) for value in flat_data.values()}
+        if len(values_count) > 1:
+            raise ParseError(f"Incorrect number of values provided for the {field} field")
+        values_count = values_count.pop()
+        return [
+            self._group_data_by_field_name({key: value[i] for key, value in flat_data.items()})
+            for i in range(values_count)
+        ]
+
     def row_elements_to_data(self, counter, row, serializer):
         """
         Parse a single row of CSV data (represented as a dict) into a dict suitable for consumption by the serializer.
@@ -171,9 +221,13 @@ class NautobotCSVParser(BaseParser):
                 continue
 
             if isinstance(serializer_field, serializers.ManyRelatedField):
-                # A list of related objects, represented as a list of composite-keys
                 if value:
-                    value = value.split(",")
+                    # A list of related objects, represented as a list of composite-keys
+                    if isinstance(value, str):
+                        value = value.split(",")
+                    # A dictionary of fields identifying the objects
+                    elif isinstance(value, dict):
+                        value = self._convert_m2m_dict_to_list_of_dicts(value, key)
                 else:
                     value = []
             elif isinstance(serializer_field, serializers.RelatedField):

nautobot/core/models/__init__.py

@@ -132,6 +132,8 @@ class BaseModel(models.Model):
         self.full_clean()
         self.save(*args, **kwargs)
 
+    validated_save.alters_data = True
+
     def natural_key(self) -> list:
         """
         Smarter default implementation of natural key construction.

nautobot/core/tests/test_csv.py

@@ -7,7 +7,7 @@ from django.urls import reverse
 
 from nautobot.core.constants import CSV_NO_OBJECT, CSV_NULL_TYPE, VARBINARY_IP_FIELD_REPR_OF_CSV_NO_OBJECT
 from nautobot.dcim.api.serializers import DeviceSerializer
-from nautobot.dcim.models.devices import Controller, Device, DeviceType
+from nautobot.dcim.models.devices import Controller, Device, DeviceType, Platform, SoftwareImageFile, SoftwareVersion
 from nautobot.dcim.models.locations import Location
 from nautobot.extras.models.roles import Role
 from nautobot.extras.models.statuses import Status
@@ -317,3 +317,94 @@ class CSVParsingRelatedTestCase(TestCase):
             tenant=self.device2.tenant,
         )
         self.assertEqual(device4.tags.count(), 0)
+
+    @override_settings(ALLOWED_HOSTS=["*"])
+    def test_m2m_field_import(self):
+        """Test CSV import of M2M field."""
+
+        platform = Platform.objects.first()
+        software_version_status = Status.objects.get_for_model(SoftwareVersion).first()
+        software_image_file_status = Status.objects.get_for_model(SoftwareImageFile).first()
+
+        software_version = SoftwareVersion.objects.create(
+            platform=platform, version="Test version 1.0.0", status=software_version_status
+        )
+        software_image_files = (
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_1.bin",
+                status=software_image_file_status,
+            ),
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_2.bin",
+                status=software_image_file_status,
+                default_image=True,
+            ),
+            SoftwareImageFile.objects.create(
+                software_version=software_version,
+                image_file_name="software_image_file_qs_test_3.bin",
+                status=software_image_file_status,
+            ),
+        )
+
+        user = UserFactory.create()
+        user.is_superuser = True
+        user.is_active = True
+        user.save()
+        self.client.force_login(user)
+
+        with self.subTest("Import M2M field using list of UUIDs"):
+            import_data = f"""name,device_type,location,role,status,software_image_files
+TestDevice5,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_image_files[0].pk},{software_image_files[1].pk}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(Device.objects.count(), 3)
+
+            # Assert TestDevice5 got created with the right fields
+            device5 = Device.objects.get(
+                name="TestDevice5",
+                location=self.device.location,
+                device_type=self.device.device_type,
+                role=self.device.role,
+                status=self.device.status,
+                tenant=None,
+            )
+            self.assertEqual(device5.software_image_files.count(), 2)
+
+        with self.subTest("Import M2M field using multiple identifying fields"):
+            import_data = f"""name,device_type,location,role,status,software_image_files__software_version,software_image_files__image_file_name
+TestDevice6,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_version.pk},{software_version.pk}","{software_image_files[0].image_file_name},{software_image_files[1].image_file_name}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(Device.objects.count(), 4)
+
+            # Assert TestDevice5 got created with the right fields
+            device6 = Device.objects.get(
+                name="TestDevice6",
+                location=self.device.location,
+                device_type=self.device.device_type,
+                role=self.device.role,
+                status=self.device.status,
+                tenant=None,
+            )
+            self.assertEqual(device6.software_image_files.count(), 2)
+
+        with self.subTest("Import M2M field using incorrect number of values"):
+            import_data = f"""name,device_type,location,role,status,software_image_files__software_version,software_image_files__image_file_name
+TestDevice7,{self.device.device_type.pk},{self.device.location.pk},{self.device.role.pk},{self.device.status.pk},"{software_version.pk},{software_version.pk}","{software_image_files[0].image_file_name},{software_image_files[1].image_file_name},{software_image_files[2].image_file_name}"
+"""
+            data = {"csv_data": import_data}
+            url = reverse("dcim:device_import")
+            response = self.client.post(url, data)
+            self.assertEqual(response.status_code, 200)
+            self.assertContains(response, "Incorrect number of values provided for the software_image_files field")
+            self.assertEqual(Device.objects.count(), 4)

nautobot/core/tests/test_jinja_filters.py

@@ -4,6 +4,8 @@ from netutils.utils import jinja2_convenience_function
 
 from nautobot.core.utils import data
 from nautobot.dcim import models as dcim_models
+from nautobot.extras import models as extras_models
+from nautobot.ipam import models as ipam_models
 
 
 class NautobotJinjaFilterTest(TestCase):
@@ -85,3 +87,60 @@ class NautobotJinjaFilterTest(TestCase):
             self.fail("SecurityError raised on safe Jinja template render")
         else:
             self.assertEqual(value, location.parent.name)
+
+    def test_render_blocks_various_unsafe_methods(self):
+        """Assert that Jinja template rendering correctly blocks various unsafe Nautobot APIs."""
+        device = dcim_models.Device.objects.first()
+        dynamic_group = extras_models.DynamicGroup.objects.first()
+        git_repository = extras_models.GitRepository.objects.create(
+            name="repo", slug="repo", remote_url="file:///", branch="main"
+        )
+        interface = dcim_models.Interface.objects.first()
+        interface_template = dcim_models.InterfaceTemplate.objects.first()
+        location = dcim_models.Location.objects.first()
+        module = dcim_models.Module.objects.first()
+        prefix = ipam_models.Prefix.objects.first()
+        secret = extras_models.Secret.objects.create(name="secret", provider="environment-variable")
+        vrf = ipam_models.VRF.objects.first()
+
+        context = {
+            "device": device,
+            "dynamic_group": dynamic_group,
+            "git_repository": git_repository,
+            "interface": interface,
+            "interface_template": interface_template,
+            "location": location,
+            "module": module,
+            "prefix": prefix,
+            "secret": secret,
+            "vrf": vrf,
+            "JobResult": extras_models.JobResult,
+            "ScheduledJob": extras_models.ScheduledJob,
+        }
+
+        for call in [
+            "device.create_components()",
+            "dynamic_group.add_members([])",
+            "dynamic_group.remove_members([])",
+            "git_repository.sync(None)",
+            "git_repository.clone_to_directory()",
+            "git_repository.cleanup_cloned_directory('/tmp/')",
+            "interface.render_name_template()",
+            "interface.add_ip_addresses([])",
+            "interface_template.instantiate(device)",
+            "interface_template.instantiate_model(interface_template, device)",
+            "location.validated_save()",
+            "module.create_components()",
+            "module.render_component_names()",
+            "prefix.reparent_ips()",
+            "prefix.reparent_subnets()",
+            "secret.get_value()",
+            "vrf.add_device(device)",
+            "vrf.add_prefix(prefix)",
+            "JobResult.enqueue_job(None, None)",
+            "JobResult.log('hello world')",
+            "ScheduledJob.create_schedule(None, None)",
+        ]:
+            with self.subTest(call=call):
+                with self.assertRaises(SecurityError):
+                    data.render_jinja2(template_code="{{ " + call + " }}", context=context)

nautobot/core/tests/test_views.py

@@ -1,5 +1,7 @@
 import json
+import os
 import re
+import tempfile
 from unittest import mock, skipIf
 import urllib.parse
 
@@ -185,6 +187,77 @@ class HomeViewTestCase(TestCase):
         self.assertNotIn("Welcome to Nautobot!", response.content.decode(response.charset))
 
 
+class MediaViewTestCase(TestCase):
+    def test_media_unauthenticated(self):
+        """
+        Test that unauthenticated users are redirected to login when accessing media files whether they exist or not.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(
+                MEDIA_ROOT=temp_dir,
+                BRANDING_FILEPATHS={"logo": os.path.join("branding", "logo.txt")},
+            ):
+                file_path = os.path.join(temp_dir, "foo.txt")
+                url = reverse("media", kwargs={"path": "foo.txt"})
+                self.client.logout()
+
+                # Unauthenticated request to nonexistent media file should redirect to login page
+                response = self.client.get(url)
+                self.assertRedirects(
+                    response, expected_url=f"{reverse('login')}?next={url}", status_code=302, target_status_code=200
+                )
+
+                # Unauthenticated request to existent media file should redirect to login page as well
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+                response = self.client.get(url)
+                self.assertRedirects(
+                    response, expected_url=f"{reverse('login')}?next={url}", status_code=302, target_status_code=200
+                )
+
+    def test_branding_media(self):
+        """
+        Test that users can access branding files listed in `settings.BRANDING_FILEPATHS` regardless of authentication.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(
+                MEDIA_ROOT=temp_dir,
+                BRANDING_FILEPATHS={"logo": os.path.join("branding", "logo.txt")},
+            ):
+                os.makedirs(os.path.join(temp_dir, "branding"))
+                file_path = os.path.join(temp_dir, "branding", "logo.txt")
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+
+                url = reverse("media", kwargs={"path": "branding/logo.txt"})
+
+                # Authenticated request succeeds
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+                # Unauthenticated request also succeeds
+                self.client.logout()
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+    def test_media_authenticated(self):
+        """
+        Test that authenticated users can access regular media files stored in the `MEDIA_ROOT`.
+        """
+        with tempfile.TemporaryDirectory() as temp_dir:
+            with override_settings(MEDIA_ROOT=temp_dir):
+                file_path = os.path.join(temp_dir, "foo.txt")
+                with open(file_path, "w") as f:
+                    f.write("Hello, world!")
+
+                url = reverse("media", kwargs={"path": "foo.txt"})
+                response = self.client.get(url)
+                self.assertHttpStatus(response, 200)
+                self.assertIn("Hello, world!", b"".join(response).decode(response.charset))
+
+
 @override_settings(BRANDING_TITLE="Nautobot")
 class SearchFieldsTestCase(TestCase):
     def test_search_bar_redirect_to_login(self):

nautobot/core/urls.py

@@ -2,13 +2,13 @@ from django.conf import settings
 from django.http import HttpResponse, HttpResponseNotFound
 from django.urls import include, path
 from django.views.generic import TemplateView
-from django.views.static import serve
 
 from nautobot.core.views import (
     AboutView,
     CustomGraphQLView,
     get_file_with_authorization,
     HomeView,
+    MediaView,
     NautobotMetricsView,
     NautobotMetricsViewAuth,
     RenderJinjaView,
@@ -51,7 +51,7 @@ urlpatterns = [
     # GraphQL
     path("graphql/", CustomGraphQLView.as_view(graphiql=True), name="graphql"),
     # Serving static media in Django (TODO: should be DEBUG mode only - "This view is NOT hardened for production use")
-    path("media/<path:path>", serve, {"document_root": settings.MEDIA_ROOT}),
+    path("media/<path:path>", MediaView.as_view(), name="media"),
     # Admin
     path("admin/", admin_site.urls),
     # Errors

nautobot/core/views/__init__.py

@@ -3,6 +3,7 @@ import datetime
 import logging
 import os
 import platform
+import posixpath
 import re
 import sys
 import time
@@ -24,6 +25,7 @@ from django.views.csrf import csrf_failure as _csrf_failure
 from django.views.decorators.csrf import requires_csrf_token
 from django.views.defaults import ERROR_500_TEMPLATE_NAME, page_not_found
 from django.views.generic import TemplateView, View
+from django.views.static import serve
 from graphene_django.views import GraphQLView
 from packaging import version
 from prometheus_client import (
@@ -133,6 +135,25 @@ class HomeView(AccessMixin, TemplateView):
         return self.render_to_response(context)
 
 
+class MediaView(AccessMixin, View):
+    """
+    Serves media files while enforcing login restrictions.
+
+    This view wraps Django's `serve()` function to ensure that access to media files (with the exception of
+    branding files defined in `settings.BRANDING_FILEPATHS`) is restricted to authenticated users.
+    """
+
+    def get(self, request, path):
+        if request.user.is_authenticated:
+            return serve(request, path, document_root=settings.MEDIA_ROOT)
+
+        # Unauthenticated users can access BRANDING_FILEPATHS only
+        if posixpath.normpath(path).lstrip("/") in settings.BRANDING_FILEPATHS.values():
+            return serve(request, path, document_root=settings.MEDIA_ROOT)
+
+        return self.handle_no_permission()
+
+
 class WorkerStatusView(UserPassesTestMixin, TemplateView):
     template_name = "utilities/worker_status.html"
 

nautobot/dcim/models/device_component_templates.py

@@ -82,6 +82,8 @@ class ComponentTemplateModel(
         """
         raise NotImplementedError()
 
+    instantiate.alters_data = True
+
     def to_objectchange(self, action, **kwargs):
         """
         Return a new ObjectChange with the `related_object` pinned to the `device_type` by default.
@@ -122,6 +124,8 @@ class ComponentTemplateModel(
             **kwargs,
         )
 
+    instantiate_model.alters_data = True
+
 
 class ModularComponentTemplateModel(ComponentTemplateModel):
     """Component Template that supports assignment to a DeviceType or a ModuleType."""

nautobot/dcim/models/device_components.py

@@ -182,6 +182,8 @@ class ModularComponentModel(ComponentModel):
                 if save:
                     self.save(update_fields=["_name", "name"])
 
+    render_name_template.alters_data = True
+
     def to_objectchange(self, action, **kwargs):
         """
         Return a new ObjectChange with the `related_object` pinned to the parent `device` or `module`.
@@ -820,6 +822,8 @@ class Interface(ModularComponentModel, CableTermination, PathEndpoint, BaseInter
                 instance.validated_save()
         return len(ip_addresses)
 
+    add_ip_addresses.alters_data = True
+
     def remove_ip_addresses(self, ip_addresses):
         """Remove one or more IPAddress instances from this interface's `ip_addresses` many-to-many relationship.
 
@@ -839,6 +843,8 @@ class Interface(ModularComponentModel, CableTermination, PathEndpoint, BaseInter
                 count += deleted_count
         return count
 
+    remove_ip_addresses.alters_data = True
+
     @property
     def is_connectable(self):
         return self.type not in NONCONNECTABLE_IFACE_TYPES
@@ -939,6 +945,8 @@ class InterfaceRedundancyGroup(PrimaryModel):  # pylint: disable=too-many-ancest
         )
         return instance.validated_save()
 
+    add_interface.alters_data = True
+
     def remove_interface(self, interface):
         """
         Remove an interface.
@@ -952,6 +960,8 @@ class InterfaceRedundancyGroup(PrimaryModel):  # pylint: disable=too-many-ancest
         )
         return instance.delete()
 
+    remove_interface.alters_data = True
+
 
 @extras_features("graphql")
 class InterfaceRedundancyGroupAssociation(BaseModel, ChangeLoggedModel):
@@ -1287,3 +1297,5 @@ class ModuleBay(PrimaryModel):
 
         if not self.position:
             self.position = self.name
+
+    clean.alters_data = True

nautobot/dcim/models/devices.py

@@ -897,6 +897,8 @@ class Device(PrimaryModel, ConfigContextModel):
             model.objects.bulk_create([x.instantiate(device=self) for x in templates])
         return instantiated_components
 
+    create_components.alters_data = True
+
     @property
     def display(self):
         if self.name:
@@ -1858,6 +1860,8 @@ class Module(PrimaryModel):
             model.objects.bulk_create([x.instantiate(device=None, module=self) for x in templates])
         return instantiated_components
 
+    create_components.alters_data = True
+
     def render_component_names(self):
         """
         Replace the {module}, {module.parent}, {module.parent.parent}, etc. template variables in descendant
@@ -1882,6 +1886,8 @@ class Module(PrimaryModel):
         for child in self.get_children():
             child.render_component_names()
 
+    render_component_names.alters_data = True
+
     def get_cables(self, pk_list=False):
         """
         Return a QuerySet or PK list matching all Cables connected to any component of this Module.

nautobot/extras/context_managers.py

@@ -254,8 +254,8 @@ def web_request_context(
             # TODO: get_snapshots() currently requires a DB query per object change processed.
             # We need to develop a more efficient approach: https://github.com/nautobot/nautobot/issues/6303
             snapshots = oc.get_snapshots(
-                pre_object_data.get(str(oc.changed_object_id), None),
-                pre_object_data_v2.get(str(oc.changed_object_id), None),
+                pre_object_data.get(str(oc.changed_object_id), None) if pre_object_data else None,
+                pre_object_data_v2.get(str(oc.changed_object_id), None) if pre_object_data_v2 else None,
             )
             webhook_queryset = enqueue_webhooks(oc, snapshots=snapshots, webhook_queryset=webhook_queryset)
 

nautobot/extras/models/customfields.py

@@ -269,6 +269,8 @@ class CustomFieldModel(models.Model):
                 elif cf.required:
                     raise ValidationError(f"Missing required custom field '{cf.key}'.")
 
+    clean.alters_data = True
+
     # Computed Field Methods
     def has_computed_fields(self, advanced_ui=None):
         """

nautobot/extras/models/datasources.py

@@ -180,6 +180,8 @@ class GitRepository(PrimaryModel):
             return enqueue_git_repository_diff_origin_and_local(self, user)
         return enqueue_pull_git_repository_and_refresh_data(self, user)
 
+    sync.alters_data = True
+
     @contextmanager
     def clone_to_directory_context(self, path=None, branch=None, head=None, depth=0):
         """
@@ -207,6 +209,8 @@ class GitRepository(PrimaryModel):
             if path_name:
                 self.cleanup_cloned_directory(path_name)
 
+    clone_to_directory_context.alters_data = True
+
     def clone_to_directory(self, path=None, branch=None, head=None, depth=0):
         """
         Perform a (shallow or full) clone of the Git repository in a temporary directory.
@@ -246,6 +250,8 @@ class GitRepository(PrimaryModel):
         logger.info(f"Cloned repository {self.name} to {path_name}")
         return path_name
 
+    clone_to_directory.alters_data = True
+
     def cleanup_cloned_directory(self, path):
         """
         Cleanup the cloned directory.
@@ -259,3 +265,5 @@ class GitRepository(PrimaryModel):
         except OSError as os_error:
             # log error if the cleanup fails
             logger.error(f"Failed to cleanup temporary directory at {path}: {os_error}")
+
+    cleanup_cloned_directory.alters_data = True

nautobot/extras/models/groups.py

@@ -338,6 +338,8 @@ class DynamicGroup(PrimaryModel):
 
         return self.members
 
+    _set_members.alters_data = True
+
     def add_members(self, objects_to_add):
         """Add the given list or QuerySet of objects to this staticly defined group."""
         if self.group_type != DynamicGroupTypeChoices.TYPE_STATIC:
@@ -354,6 +356,8 @@ class DynamicGroup(PrimaryModel):
             objects_to_add = [obj for obj in objects_to_add if obj not in existing_members]
         return self._add_members(objects_to_add)
 
+    add_members.alters_data = True
+
     def _add_members(self, objects_to_add):
         """
         Internal API for adding the given list or QuerySet of objects to the cached/static members of this group.
@@ -377,6 +381,8 @@ class DynamicGroup(PrimaryModel):
             ]
             StaticGroupAssociation.all_objects.bulk_create(sgas, batch_size=1000)
 
+    _add_members.alters_data = True
+
     def remove_members(self, objects_to_remove):
         """Remove the given list or QuerySet of objects from this staticly defined group."""
         if self.group_type != DynamicGroupTypeChoices.TYPE_STATIC:
@@ -390,6 +396,8 @@ class DynamicGroup(PrimaryModel):
                     raise TypeError(f"{obj} is not a {self.model._meta.label_lower}")
         return self._remove_members(objects_to_remove)
 
+    remove_members.alters_data = True
+
     def _remove_members(self, objects_to_remove):
         """Internal API for removing the given list or QuerySet from the cached/static members of this Group."""
         from nautobot.extras.signals import _handle_deleted_object  # avoid circular import
@@ -418,6 +426,8 @@ class DynamicGroup(PrimaryModel):
                 logger.debug("Re-connecting the _handle_deleted_object signal")
                 pre_delete.connect(_handle_deleted_object)
 
+    _remove_members.alters_data = True
+
     @property
     @method_deprecated("Members are now cached in the database via StaticGroupAssociations rather than in Redis.")
     def members_cache_key(self):
@@ -451,6 +461,8 @@ class DynamicGroup(PrimaryModel):
 
         return members
 
+    update_cached_members.alters_data = True
+
     def has_member(self, obj, use_cache=False):
         """
         Return True if the given object is a member of this group.
@@ -560,6 +572,8 @@ class DynamicGroup(PrimaryModel):
 
         self.filter = new_filter
 
+    set_filter.alters_data = True
+
     def get_initial(self):
         """
         Return a form-friendly version of `self.filter` for initial form data.
@@ -815,6 +829,8 @@ class DynamicGroup(PrimaryModel):
         instance = self.children.through(parent_group=self, group=child, operator=operator, weight=weight)
         return instance.validated_save()
 
+    add_child.alters_data = True
+
     # TODO: unused in core
     def remove_child(self, child):
         """
@@ -829,6 +845,8 @@ class DynamicGroup(PrimaryModel):
         instance = self.children.through.objects.get(parent_group=self, group=child)
         return instance.delete()
 
+    remove_child.alters_data = True
+
     def get_descendants(self, group=None):
         """
         Recursively return a list of the children of all child groups.