diff options
| author | Simon Charette <charette.s@gmail.com> | 2025-04-04 10:18:27 -0400 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2025-04-05 21:38:06 +0200 |
| commit | cd1aa54f5a1ad8673f8852aa3b0022c06b154b79 (patch) | |
| tree | 804f45f32260984c46c2c1809bc8543589dc9aca /tests/annotations | |
| parent | d9bf0d07cc13c0351b65b025d7e8063864086975 (diff) | |
[5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.
Refs #28900.
Thanks Jeff Iadarola for the report and tests.
Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
Backport of 12b771a1ec4bbfe82405176f5601e6441855a303 from main
Diffstat (limited to 'tests/annotations')
| -rw-r--r-- | tests/annotations/tests.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/tests/annotations/tests.py b/tests/annotations/tests.py index 5df958c333..6c0d7b668c 100644 --- a/tests/annotations/tests.py +++ b/tests/annotations/tests.py @@ -1470,6 +1470,10 @@ class AliasTests(TestCase): with self.assertRaisesMessage(FieldError, msg): getattr(qs, operation)("rating_alias") + def test_alias_after_values(self): + qs = Book.objects.values_list("pk").alias(other_pk=F("pk")) + self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,)) + def test_alias_sql_injection(self): crafted_alias = """injected_name" from "annotations_book"; --""" msg = ( |