diff options
| author | Simon Charette <charette.s@gmail.com> | 2025-04-04 10:18:27 -0400 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2025-04-05 21:38:06 +0200 |
| commit | cd1aa54f5a1ad8673f8852aa3b0022c06b154b79 (patch) | |
| tree | 804f45f32260984c46c2c1809bc8543589dc9aca | |
| parent | d9bf0d07cc13c0351b65b025d7e8063864086975 (diff) | |
[5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.
Refs #28900.
Thanks Jeff Iadarola for the report and tests.
Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
Backport of 12b771a1ec4bbfe82405176f5601e6441855a303 from main
| -rw-r--r-- | django/db/models/sql/query.py | 2 | ||||
| -rw-r--r-- | docs/releases/5.2.1.txt | 4 | ||||
| -rw-r--r-- | tests/annotations/tests.py | 4 |
3 files changed, 9 insertions, 1 deletions
diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py index 9fde8496e9..4d31c36175 100644 --- a/django/db/models/sql/query.py +++ b/django/db/models/sql/query.py @@ -1221,7 +1221,7 @@ class Query(BaseExpression): else: self.set_annotation_mask(set(self.annotation_select).difference({alias})) self.annotations[alias] = annotation - if self.selected: + if select and self.selected: self.selected[alias] = alias @property diff --git a/docs/releases/5.2.1.txt b/docs/releases/5.2.1.txt index 0f95eda848..53f18152ae 100644 --- a/docs/releases/5.2.1.txt +++ b/docs/releases/5.2.1.txt @@ -19,3 +19,7 @@ Bugfixes * Fixed a regression in Django 5.2 that caused a crash of ``QuerySet.bulk_create()`` with nullable geometry fields on PostGIS (:ticket:`36289`). + +* Fixed a regression in Django 5.2 that caused fields to be incorrectly + selected when using ``QuerySet.alias()`` after ``values()`` + (:ticket:`36299`). diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py index 5df958c333..6c0d7b668c 100644 --- a/tests/annotations/tests.py +++ b/tests/annotations/tests.py @@ -1470,6 +1470,10 @@ class AliasTests(TestCase): with self.assertRaisesMessage(FieldError, msg): getattr(qs, operation)("rating_alias") + def test_alias_after_values(self): + qs = Book.objects.values_list("pk").alias(other_pk=F("pk")) + self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,)) + def test_alias_sql_injection(self): crafted_alias = """injected_name" from "annotations_book"; --""" msg = ( |