Fixed related model lookup regression

It has been possible to use models of wrong type in related field
lookups. For example pigs__in=[a_duck] has worked. Changes to
ForeignObject broke that.

It might be a good idea to restrict the model types usable in lookups.
This should be done intentionally, not accidentally and without any
consideration for deprecation path.

2 files changed, 17 insertions, 1 deletions

diff --git a/django/db/models/fields/related.py b/django/db/models/fields/related.py
index 11a20983eb..b84693eba4 100644
--- a/django/db/models/fields/related.py
+++ b/django/db/models/fields/related.py
@@ -1060,7 +1060,7 @@ class ForeignObject(RelatedField):
                 value_list = []
                 for source in sources:
                     # Account for one-to-one relations when sent a different model
-                    while not isinstance(value, source.model):
+                    while not isinstance(value, source.model) and source.rel:
                         source = source.rel.to._meta.get_field(source.rel.field_name)
                     value_list.append(getattr(value, source.attname))
                 return tuple(value_list)
diff --git a/tests/queries/tests.py b/tests/queries/tests.py
index 4bacd9a1cc..514b0ee5d7 100644
--- a/tests/queries/tests.py
+++ b/tests/queries/tests.py
@@ -2939,3 +2939,19 @@ class Ticket20788Tests(TestCase):
             chapter__paragraph__page=page)
         self.assertQuerysetEqual(
             sentences_not_in_pub, [book2], lambda x: x)
+
+class RelatedLookupTypeTests(TestCase):
+    def test_wrong_type_lookup(self):
+        oa = ObjectA.objects.create(name="oa")
+        wrong_type = Order.objects.create(id=oa.pk)
+        ob = ObjectB.objects.create(name="ob", objecta=oa, num=1)
+        # Currently Django doesn't care if the object is of correct
+        # type, it will just use the objecta's related fields attribute
+        # (id) for model lookup. Making things more restrictive could
+        # be a good idea...
+        self.assertQuerysetEqual(
+            ObjectB.objects.filter(objecta=wrong_type),
+            [ob], lambda x: x)
+        self.assertQuerysetEqual(
+            ObjectB.objects.filter(objecta__in=[wrong_type]),
+            [ob], lambda x: x)