django.git/tests/ordering/tests.py, branch main

Fixed #36857 -- Added QuerySet.totally_ordered property.

2026-02-13T21:58:36Z

Thanks Simon Charette for the idea.

Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T12:56:04Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795.

Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

2026-02-03T12:55:33Z

Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews.

Fixed #36407 -- Ensured default value is cast in Case expressions used in ORDER BY clause.

2025-06-05T07:52:56Z

Thanks to deceze for the report. Thanks to Sarah Boyce for the test. Thanks to Simon Charette for the investigation and review.

Fixed #34372 -- Fixed queryset crash on order by aggregation using OrderBy.

2023-02-27T06:10:19Z

Regression in 278881e37619278789942513916acafaa88d26f3 caused by a lack of expression copying when an OrderBy expression is explicitly provided. Thanks Jannis Vajen for the report and regression test.

Fixed #34346 -- Ordered selected expressions by position.

2023-02-20T04:54:25Z

Used the same approach as for #34176 by using selected expressions position to prevent ambiguous aliases in collisions. Thanks henribru for the report. Regression in 04518e310d4552ff7595a34f5a7f93487d78a406.

Refs #33308 -- Added tests for queryset ordered by annotation with nulls_first/nulls_last.

2023-02-18T15:28:10Z

Fixed #34105 -- Fixed crash of ordering by nested selected expression.

2022-10-19T00:31:45Z

This stops ordering by nested selected references. It's not supported on PostgreSQL and not required to support psycopg3. Regression in 04518e310d4552ff7595a34f5a7f93487d78a406. Thanks Matt Westcott for the report.

Refs #33990 -- Renamed TransactionTestCase.assertQuerysetEqual() to assertQuerySetEqual().

2022-10-08T06:07:38Z

Co-Authored-By: Michael Howitz

Fixed #34012 -- Made QuerySet.order_by() apply transforms on related fields for models with Meta.ordering.

2022-10-04T06:19:34Z

This makes QuerySet.order_by() no longer ignore trailing transforms for models with Meta.ordering. As a consequence, FieldError is raised in such cases for non-existent fields. Thanks to Klaas van Schelven for the report and Mariusz Felisiak for the review and advice.