django

mirror of https://github.com/django/django.git synced 2025-10-09 14:59:24 +00:00

History

Mariusz Felisiak 52fbae0a4d [5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

2025-10-01 08:24:18 -04:00

__init__.py

Fixed #14030 -- Allowed annotations to accept all expressions

2014-11-15 14:00:43 +00:00

models.py

Fixed #35586 -- Added support for set-returning database functions.

2024-08-12 15:35:19 +02:00

tests.py

[5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01 08:24:18 -04:00