Changes to M2M fields from the reverse relation are logged incorrectly

[hackoder]

See here for minimal test showcasing the issue: hackoder@742bdf6

We track changes to Django user group memberships using:

auditlog.register(User, m2m_fields=["groups"])

and then Group membership changes are made in bulk using something like:

my_group.user_set.add(*list_of_users)

This results in the m2m_changed signal being fired from the reverse relationship (i.e. Group). Changes are logged against the Group model (instead of the User model), with the field_name also set to groups (a field that is non-existent on Group), and the actual objects pointing to user instances.

Note that the m2m_changed signal includes information specifying if its the reverse relationship (see: https://docs.djangoproject.com/en/4.2/ref/signals/#m2m-changed), however the code for logging m2m changes does not differentiate which side of the relationship is being updated.

IMO this should be updated so changes to the reverse side of the relationship are logged to the correct model (i.e. the side that has tracking for the field, or both if both sides are being tracked), and obviously using the right field names and pointing to the correct objects.

[DaBenjle]

+1