django.git/tests/ordering/tests.py, branch stable/5.2.x

[5.2.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.

2026-02-03T13:19:02Z

This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795. Backport of 005d60d97c4dfb117503bdb6f2facfcaf9315d84 from main.

[5.2.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.

2026-02-03T13:18:30Z

Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews. Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.

Fixed #34372 -- Fixed queryset crash on order by aggregation using OrderBy.

2023-02-27T06:10:19Z

Regression in 278881e37619278789942513916acafaa88d26f3 caused by a lack of expression copying when an OrderBy expression is explicitly provided. Thanks Jannis Vajen for the report and regression test.

Fixed #34346 -- Ordered selected expressions by position.

2023-02-20T04:54:25Z

Used the same approach as for #34176 by using selected expressions position to prevent ambiguous aliases in collisions. Thanks henribru for the report. Regression in 04518e310d4552ff7595a34f5a7f93487d78a406.

Refs #33308 -- Added tests for queryset ordered by annotation with nulls_first/nulls_last.

2023-02-18T15:28:10Z

Fixed #34105 -- Fixed crash of ordering by nested selected expression.

2022-10-19T00:31:45Z

This stops ordering by nested selected references. It's not supported on PostgreSQL and not required to support psycopg3. Regression in 04518e310d4552ff7595a34f5a7f93487d78a406. Thanks Matt Westcott for the report.

Refs #33990 -- Renamed TransactionTestCase.assertQuerysetEqual() to assertQuerySetEqual().

2022-10-08T06:07:38Z

Co-Authored-By: Michael Howitz

Fixed #34012 -- Made QuerySet.order_by() apply transforms on related fields for models with Meta.ordering.

2022-10-04T06:19:34Z

This makes QuerySet.order_by() no longer ignore trailing transforms for models with Meta.ordering. As a consequence, FieldError is raised in such cases for non-existent fields. Thanks to Klaas van Schelven for the report and Mariusz Felisiak for the review and advice.

Fixed #29538 -- Fixed crash of ordering by related fields when Meta.ordering contains expressions.

2022-05-12T05:19:16Z

Thanks Simon Charette for the review.

Removed redundant QuerySet.all() calls in docs and tests.

2022-02-22T09:29:38Z

Most QuerySet methods are mapped onto the Manager and, in general, it isn't necessary to call .all() on the manager.