toastdriven/django-tastypie — pull request #954 by willembult (2013-06-06 05:36:05+00:00)
Title: Don't try to update resources in case of a create

The resource_from_data method creates a resource based on a data dictionary. However, when this method is called on a related resource in the process of a create, and a primary key is not included in the related resource, a resource may inadvertently be selected that is not at all supposed to be updated.

In the following scenario:

````python
class PaymentResource(ModelResource):
class Meta:
fields = ['id','scheduled']

class JobResource(ModelResource):
payment = ToOneField(PaymentResource, 'payment')
class Meta:
fields = ['id','name']
````

When I submit a POST request to /api/job with the following:
```javascript
{
name: 'some_job',
payment: {
scheduled: '2013-06-01'
}
}
````

The resource_from_data will be called with the dictionary of the payment, matching any payment that has the same scheduled date, not related to the current job being created at all. For safety, when a unique key is not supplied in the dictionary, we should not try to find a resource to update.