1
0
mirror of https://github.com/django/django.git synced 2025-04-16 21:34:37 +00:00

Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900.

Thanks Jeff Iadarola for the report and tests.

Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
This commit is contained in:
Simon Charette 2025-04-04 10:18:27 -04:00 committed by Mariusz Felisiak
parent 25f97e7bcf
commit 12b771a1ec
3 changed files with 9 additions and 1 deletions

View File

@ -1221,7 +1221,7 @@ class Query(BaseExpression):
else:
self.set_annotation_mask(set(self.annotation_select).difference({alias}))
self.annotations[alias] = annotation
if self.selected:
if select and self.selected:
self.selected[alias] = alias
@property

View File

@ -19,3 +19,7 @@ Bugfixes
* Fixed a regression in Django 5.2 that caused a crash of
``QuerySet.bulk_create()`` with nullable geometry fields on PostGIS
(:ticket:`36289`).
* Fixed a regression in Django 5.2 that caused fields to be incorrectly
selected when using ``QuerySet.alias()`` after ``values()``
(:ticket:`36299`).

View File

@ -1470,6 +1470,10 @@ class AliasTests(TestCase):
with self.assertRaisesMessage(FieldError, msg):
getattr(qs, operation)("rating_alias")
def test_alias_after_values(self):
qs = Book.objects.values_list("pk").alias(other_pk=F("pk"))
self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,))
def test_alias_sql_injection(self):
crafted_alias = """injected_name" from "annotations_book"; --"""
msg = (