1
0
mirror of https://github.com/django/django.git synced 2025-10-10 23:39:11 +00:00

576 Commits

Author SHA1 Message Date
Jake Howard
4c044fcc86 [5.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL injection in column aliases.
Thanks Eyal Gabay (EyalSec) for the report.

Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.
2025-09-03 13:15:55 +02:00
SaJH
ace59cb83b [5.2.x] Fixed #36431 -- Returned tuples for multi-column ForeignObject in values()/values_list().
Thanks Jacob Walls and Simon Charette for tests.

Signed-off-by: SaJH <wogur981208@gmail.com>

Backport of bb7a7701b1a0e8fffe14dcebf5d5bac7f176c02a from main
2025-08-29 15:36:09 -04:00
Jacob Walls
6228a35095 [5.2.x] Fixed #36392 -- Raised ValueError when subquery referencing composite pk selects too many columns.
Backport of 994dc6d8a1bae717baa236b65e11cf91ce181c53 from main.
2025-05-16 08:21:18 +02:00
Simon Charette
cd1aa54f5a [5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900.

Thanks Jeff Iadarola for the report and tests.

Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>

Backport of 12b771a1ec4bbfe82405176f5601e6441855a303 from main
2025-04-05 21:38:06 +02:00
Simon Charette
317690403a [5.2.x] Fixed #36292 -- Fixed crash when aggregating over a group mixing transforms and references.
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900

Thanks Patrick Altman for the report.

Backport of 543e17c4405dfdac4f18759fc78b190406d14239 from main
2025-04-03 18:35:11 +02:00
Simon Charette
dc1c9b4ddd [5.2.x] Fixed #36149 -- Allowed subquery values against tuple exact and in lookups.
Non-tuple exact and in lookups have specialized logic for subqueries that can
be adapted to properly assign select mask if unspecified and ensure the number
of involved members are matching on both side of the operator.

Backport of 41239fe34d64e801212dccaa4585e4802d0fac68 from main.
2025-02-11 09:16:44 +01:00
Simon Charette
8aea6b802c [5.2.x] Fixed #35677 -- Avoided non-sticky filtering of prefetched many-to-many.
The original queryset._next_is_sticky() call never had the intended effect as
no further filtering was applied internally after the pk__in lookup making it
a noop.

In order to be coherent with how related filters are applied when retrieving
objects from a related manager the effects of what calling _next_is_sticky()
prior to applying annotations and filters to the queryset provided for
prefetching are emulated by allowing the reuse of all pre-existing JOINs.

Thanks David Glenck and Thiago Bellini Ribeiro for the detailed reports and
tests.

Backport of 2598b371a93e21d84b7a2a99b2329535c8c0c138 from main.
2025-02-06 14:31:32 +01:00
Peter DeVita
720ef7a867 [5.2.x] Fixed #36109 -- Fixed RecursionError when stacking FilteredRelation joins.
Backport of 8eca4077f60fa0705ecfd9437c9ceaeef7a3808b from main.
2025-01-27 10:34:16 +01:00
Jacob Walls
c3a681659c Fixed #36029 -- Handled implicit exact lookups in condition depth checks for FilteredRelation. 2025-01-03 08:40:13 +01:00
Bendeguz Csirmaz
978aae4334 Fixed #373 -- Added CompositePrimaryKey.
Thanks Lily Foote and Simon Charette for reviews and mentoring
this Google Summer of Code 2024 project.

Co-authored-by: Simon Charette <charette.s@gmail.com>
Co-authored-by: Lily Foote <code@lilyf.org>
2024-11-29 11:23:04 +01:00
Simon Charette
53ea4cce2f
Fixed #35744 -- Relabelled external aliases of combined queries.
Just like normal queries, combined queries' outer references might fully
resolve before their reference is assigned its final alias.

Refs #29338.

Thanks Antony_K for the report and example, and thanks Mariusz Felisiak
for the review.
2024-10-14 20:21:48 -03:00
Devin Cox
e03083917d Fixed #35586 -- Added support for set-returning database functions.
Aggregation optimization didn't account for not referenced set-returning annotations on Postgres.

Co-authored-by: Simon Charette <charette.s@gmail.com>
2024-08-12 15:35:19 +02:00
Simon Charette
c87bfaacf8 Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.
Thanks Eyal (eyalgabay) for the report.
2024-08-06 08:50:08 +02:00
Bendeguz Csirmaz
1eac690d25 Refs #373 -- Added tuple lookups. 2024-08-01 17:26:09 +02:00
Flavio Curella
f9bf616597
Fixed #35585 -- Corrected Query.exists() call in Query.has_results(). 2024-07-23 11:36:26 -03:00
wookkl
759abc4daf Fixed #35413 -- Made unsupported lookup error message more specific. 2024-07-09 09:15:38 +02:00
Simon Charette
0e65abd2d9 Refs #28900 -- Made Query.has_select_fields a computed property.
This should ensure it never drifts from Query.selected while maintaining
backward compatibility.
2024-07-03 16:36:25 +02:00
Simon Charette
65ad4ade74 Refs #28900 -- Made SELECT respect the order specified by values(*selected).
Previously the order was always extra_fields + model_fields + annotations with
respective local ordering inferred from the insertion order of *selected.

This commits introduces a new `Query.selected` propery that keeps tracks of the
global select order as specified by on values assignment. This is crucial
feature to allow the combination of queries mixing annotations and table
references.

It also allows the removal of the re-ordering shenanigans perform by
ValuesListIterable in order to re-map the tuples returned from the database
backend to the order specified by values_list() as they'll be in the right
order at query compilation time.

Refs #28553 as the initially reported issue that was only partially fixed
for annotations by d6b6e5d0fd4e6b6d0183b4cf6e4bd4f9afc7bf67.

Thanks Mariusz Felisiak and Sarah Boyce for review.
2024-07-03 16:36:25 +02:00
Simon Charette
2a7497b036 Used Query.add_annotation where appropriate.
This avoids manual .annotations and .append_annotation_mask manipulations.
2024-06-25 14:02:20 +02:00
Simon Charette
195d885ca0 Refs #35356 -- Clarified select related with masked field logic.
By always including related objects in the select mask via adjusting the
defer logic (_get_defer_select_mask()), it becomes possible for
select_related_descend() to treat forward and reverse relationships
indistinctively.

This work also simplifies and adds comments to
select_related_descend() to make it easier to understand.
2024-04-23 13:17:17 -03:00
Simon Charette
83f5478225 Fixed #35356 -- Deferred self-referential foreign key fields adequately.
While refs #34612 surfaced issues with reverse one-to-one fields
deferrals, it missed that switching to storing remote fields would break
self-referential relationships.

This change switches to storing related objects in the select mask
instead of remote fields to prevent collisions when dealing with
self-referential relationships that might have a different directional
mask.

Despite fixing #21204 introduced a crash under some self-referential
deferral conditions, it was simply not working even before that as it
aggregated the sets of deferred fields by model.

Thanks Joshua van Besouw for the report and Mariusz Felisiak for the
review.
2024-04-23 13:17:17 -03:00
Hisham Mahmood
d79fba7d8e Fixed #35099 -- Prevented mutating queryset when combining with & and | operators.
Thanks Alan for the report.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2024-02-07 12:36:30 +01:00
Nicolas Delaby
820c5f1bac Fixed #35135 -- Made FilteredRelation raise ValueError on querysets as rhs.
Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.
2024-01-29 20:29:49 +01:00
Mariusz Felisiak
305757aec1
Applied Black's 2024 stable style.
https://github.com/psf/black/releases/tag/24.1.0
2024-01-26 12:45:07 +01:00
Mariusz Felisiak
f3d10546a8 Refs #35102 -- Optimized replace_expressions()/relabelling aliases by adding early return.
This avoids costly hashing.

Thanks Anthony Shaw for the report.

Co-Authored-By: Simon Charette <charette.s@gmail.com>
2024-01-15 05:56:38 +01:00
David Wobrock
14917c9ae2 Fixed #35050 -- Fixed prefixing field names in FilteredRelation().
Thanks Mark Zorn for the report.

Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.
2023-12-23 17:35:13 +01:00
Simon Charette
77278929c8 Fixed #35042 -- Fixed a count() crash on combined queries.
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.

Thanks Marcin for the report.
2023-12-16 20:19:24 +01:00
Simon Charette
d7a9f006ed Refs #34717 -- Avoided computing aggregate refs twice. 2023-11-18 15:41:25 +01:00
Simon Charette
15cb3c262a Refs #34975 -- Complemented rhs filtering aggregations for __in lookup.
While this isn't a regression it's clear that similar logic should be
applied when dealing with lists of expressions passed as a lookup value.
2023-11-18 15:40:52 +01:00
Simon Charette
7530cf3900 Fixed #34975 -- Fixed crash of conditional aggregate() over aggregations.
Adjustments made to solve_lookup_type to defer the resolving of
references for summarized aggregates failed to account for similar
requirements for lookup values which can also reference annotations
through Aggregate.filter.

Regression in b181cae2e3697b2e53b5b67ac67e59f3b05a6f0d.

Refs #25307.

Thanks Sergey Nesterenko for the report.
2023-11-18 15:38:04 +01:00
Simon Charette
3b4a571275 Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing expressions containing subqueries.
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7,
complements e5c844d6f2a4ac6ae674d741b5f1fa2a688cedf4.

Refs #28477, #34551.

Thanks Haldun Komsuoglu for the report.
2023-10-16 05:37:30 +02:00
Francesco Panico
59f4754704 Fixed #34362 -- Fixed FilteredRelation() crash on conditional expressions.
Thanks zhu for the report and Simon Charette for reviews.
2023-08-11 12:32:18 +02:00
Francesco Panico
1506f498fe Fixed #34743 -- Fixed Meta.constraints validation crash when using pk.
Thanks Nwawel A Iroume for the report.
2023-08-11 08:51:29 +02:00
Mariusz Felisiak
9b9c805ced
Removed unneeded escapes in regexes.
Special characters lose their special meaning inside sets of characters.

"-" lose its special meaning if it's placed as the first or last
character.

Follow up to 7c6b66383da5f9a67142334cd2ed2d769739e8f1.
2023-08-02 19:53:16 +02:00
Mariusz Felisiak
c9b9a52edc
Fixed #34750 -- Fixed QuerySet.count() when grouping by unused multi-valued annotations.
Thanks Toan Vuong for the report.
Thanks Simon Charette for the review.

Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.
2023-08-01 16:16:28 +02:00
Francesco Panico
afc880571d Refs #34362 -- Added get_child_with_renamed_prefix() hook. 2023-07-21 09:33:16 +02:00
Simon Charette
68912e4f6f Fixed #34717 -- Fixed QuerySet.aggregate() crash when referencing window functions.
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.

Refs #28477.

Thanks younes-chaoui for the report.
2023-07-19 08:21:33 +02:00
Simon Charette
1c4f5f314e Refs #32143 -- Removed superflous constraints on excluded query.
The outer query reference is not necessary when alias can be reused and
can even be harmful by confusing query planers.

Refs #34597.
2023-06-14 09:44:49 +02:00
Simon Charette
cfc9c94d97 Refs #32143 -- Adjusted a comment about subquery usage in Query.split_exclude(). 2023-06-14 08:20:39 +02:00
Simon Charette
2cf76f2d5d Fixed #34612 -- Fixed QuerySet.only() crash on reverse relationships.
Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879.

Thanks Ian Cubitt for the report.

This also corrected test_inheritance_deferred2() test which was
previously properly defined and marked as an expected failure but was
then wrongly adjusted to mask the lack of support for per-alias
deferral that was fixed by #21204.
2023-06-01 19:50:47 +01:00
Simon Charette
e5c844d6f2 Fixed #34551 -- Fixed QuerySet.aggregate() crash when referencing subqueries.
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.

Refs #28477.

Thanks Denis Roldán and Mariusz for the test.
2023-05-23 06:25:58 +02:00
Simon Charette
2ee01747c3 Refs #34551 -- Fixed QuerySet.aggregate() crash on precending aggregation reference.
Regression in 1297c0d0d76a708017fe196b61a0ab324df76954.

Refs #31679.
2023-05-23 06:25:27 +02:00
Simon Charette
99e5dff737 Fixed #34570 -- Silenced noop deferral of many-to-many and GFK.
While deferring many-to-many and GFK has no effect, the previous
implementation of QuerySet.defer() ignore them instead of crashing.

Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879.

Thanks Paco Martínez for the report.
2023-05-17 08:06:11 +02:00
Simon Charette
83c9765f45 Refs #33766 -- Removed sql.Query.build_filtered_relation_q().
It was a copy of sql.Query._add_q that avoided JOIN updates.
2023-04-24 08:32:49 +02:00
Simon Charette
d660cee5bc Fixed #33766 -- Resolved FilteredRelation.condition at referencing time.
The previous implementation resolved condition at Join compilation time
which required introducing a specialized expression resolving mode to
alter the join reuse logic solely during that phase.

FilteredRelation.condition is now resolved when the relation is first
referenced which maintains the existing behavior while allowing the
removal of the specialized resolving mode and address an issue where
conditions couldn't spawn new joins.
2023-04-24 08:32:44 +02:00
Simon Charette
9daf8b4109 Fixed #34464 -- Fixed queryset aggregation over group by reference.
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.

Refs #28477.

Thanks Ian Cubitt for the report.
2023-04-07 06:57:32 +02:00
Simon Charette
87c63bd8df Fixed #34458 -- Fixed QuerySet.defer() crash on attribute names.
Thanks Andrew Cordery for the report.

Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879.
2023-04-05 05:38:10 +02:00
Simon Charette
0e1aae7a5f Fixed #34450 -- Fixed multi-valued JOIN reuse when filtering by expressions.
Thanks Roman Odaisky for the report.
2023-04-04 14:35:21 +02:00
Mariusz Felisiak
3afdc9e9b4
Refs #29799 -- Added field instance lookups to suggestions in FieldErrors.
Bug in cd1afd553f9c175ebccfc0f50e72b43b9604bd97.
2023-03-28 19:18:48 +02:00
Simon Charette
cb13792938
Fixed #34437 -- Made values() resolving error mention selected annotations.
While the add_fields() call from set_values() does trigger validation it
does so after annotations are masked resulting in them being excluded
from the choices of valid options surfaced through a FieldError.
2023-03-25 20:22:45 +01:00