Fixed #24978 -- Escaped special characters in loaddata fixture paths

2 files changed, 39 insertions, 1 deletions

diff --git a/django/core/management/commands/loaddata.py b/django/core/management/commands/loaddata.py
index 32a676d846..af108e08e1 100644
--- a/django/core/management/commands/loaddata.py
+++ b/django/core/management/commands/loaddata.py
@@ -21,6 +21,7 @@ from django.utils import lru_cache
 from django.utils._os import upath
 from django.utils.encoding import force_text
 from django.utils.functional import cached_property
+from django.utils.glob import glob_escape
 
 try:
     import bz2
@@ -209,7 +210,8 @@ class Command(BaseCommand):
             if self.verbosity >= 2:
                 self.stdout.write("Checking %s for fixtures..." % humanize(fixture_dir))
             fixture_files_in_dir = []
-            for candidate in glob.iglob(os.path.join(fixture_dir, fixture_name + '*')):
+            path = os.path.join(fixture_dir, fixture_name)
+            for candidate in glob.iglob(glob_escape(path) + '*'):
                 if os.path.basename(candidate) in targets:
                     # Save the fixture_dir and fixture_name for future error messages.
                     fixture_files_in_dir.append((candidate, fixture_dir, fixture_name))
diff --git a/django/utils/glob.py b/django/utils/glob.py
new file mode 100644
index 0000000000..a3138b09dc
--- /dev/null
+++ b/django/utils/glob.py
@@ -0,0 +1,36 @@
+from __future__ import unicode_literals
+
+import os.path
+import re
+
+from django.utils import six
+
+# backport of Python 3.4's glob.escape
+
+try:
+    from glob import escape as glob_escape
+except ImportError:
+    _magic_check = re.compile('([*?[])')
+
+    if six.PY3:
+        _magic_check_bytes = re.compile(b'([*?[])')
+
+        def glob_escape(pathname):
+            """
+            Escape all special characters.
+            """
+            drive, pathname = os.path.splitdrive(pathname)
+            if isinstance(pathname, bytes):
+                pathname = _magic_check_bytes.sub(br'[\1]', pathname)
+            else:
+                pathname = _magic_check.sub(r'[\1]', pathname)
+            return drive + pathname
+
+    else:
+        def glob_escape(pathname):
+            """
+            Escape all special characters.
+            """
+            drive, pathname = os.path.splitdrive(pathname)
+            pathname = _magic_check.sub(r'[\1]', pathname)
+            return drive + pathname