mirror of
https://github.com/django/django.git
synced 2025-04-16 21:34:37 +00:00
Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Jeff Iadarola for the report and tests. Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
This commit is contained in:
parent
25f97e7bcf
commit
12b771a1ec
@ -1221,7 +1221,7 @@ class Query(BaseExpression):
|
||||
else:
|
||||
self.set_annotation_mask(set(self.annotation_select).difference({alias}))
|
||||
self.annotations[alias] = annotation
|
||||
if self.selected:
|
||||
if select and self.selected:
|
||||
self.selected[alias] = alias
|
||||
|
||||
@property
|
||||
|
@ -19,3 +19,7 @@ Bugfixes
|
||||
* Fixed a regression in Django 5.2 that caused a crash of
|
||||
``QuerySet.bulk_create()`` with nullable geometry fields on PostGIS
|
||||
(:ticket:`36289`).
|
||||
|
||||
* Fixed a regression in Django 5.2 that caused fields to be incorrectly
|
||||
selected when using ``QuerySet.alias()`` after ``values()``
|
||||
(:ticket:`36299`).
|
||||
|
@ -1470,6 +1470,10 @@ class AliasTests(TestCase):
|
||||
with self.assertRaisesMessage(FieldError, msg):
|
||||
getattr(qs, operation)("rating_alias")
|
||||
|
||||
def test_alias_after_values(self):
|
||||
qs = Book.objects.values_list("pk").alias(other_pk=F("pk"))
|
||||
self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,))
|
||||
|
||||
def test_alias_sql_injection(self):
|
||||
crafted_alias = """injected_name" from "annotations_book"; --"""
|
||||
msg = (
|
||||
|
Loading…
x
Reference in New Issue
Block a user