summaryrefslogtreecommitdiff
path: root/django/db/models/sql/query.py
AgeCommit message (Collapse)Author
2022-04-11[4.0.x] Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) ↵Mariusz Felisiak
against SQL injection on PostgreSQL. Backport of 6723a26e59b0b5429a0c5873941e01a2e1bdbb81 from main.
2022-04-11[4.0.x] Fixed CVE-2022-28346 -- Protected QuerySet.annotate(), aggregate(), ↵Mariusz Felisiak
and extra() against SQL injection in column aliases. Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report. Backport of 93cae5cb2f9a4ef1514cf1a41f714fef08005200 from main.
2022-03-30[4.0.x] Fixed #33598 -- Reverted "Removed unnecessary ↵Mariusz Felisiak
reuse_with_filtered_relation argument from Query methods." Thanks lind-marcus for the report. This reverts commit 0c71e0f9cfa714a22297ad31dd5613ee548db379. Regression in 0c71e0f9cfa714a22297ad31dd5613ee548db379. Backport of fac662f4798f7e4e0ed9be6b4fb4a87a80810a68 from main
2022-02-08[4.0.x] Refs #33476 -- Refactored code to strictly match 88 characters line ↵Mariusz Felisiak
length. Backport of 7119f40c9881666b6f9b5cf7df09ee1d21cc8344 from main.
2022-02-08[4.0.x] Refs #33476 -- Reformatted code with Black.django-bot
Backport of 9c19aff7c7561e3a82978a272ecdaad40dda5c00 from main.
2022-02-03[4.0.x] Refs #33476 -- Refactored problematic code before reformatting by Black.Mariusz Felisiak
In these cases Black produces unexpected results, e.g. def make_random_password( self, length=10, allowed_chars='abcdefghjkmnpqrstuvwxyz' 'ABCDEFGHJKLMNPQRSTUVWXYZ' '23456789', ): or cursor.execute(""" SELECT ... """, [table name], ) Backport of c5cd8783825b5f6384417dac5f3889b4210b7d08 from main.
2021-09-29[4.0.x] Fixed #33018 -- Fixed annotations with empty queryset.David Wobrock
Thanks Simon Charette for the review and implementation idea. Backport of dd1fa3a31b4680c0d3712e6ae122b878138580c7 from main
2021-09-29[4.0.x] Fixed #33141 -- Renamed Expression.empty_aggregate_value to ↵David Wobrock
empty_result_set_value. Backport of ad36a198a12df4dff65992191b3eb0a474e2daac from main
2021-09-20Refs #27624 -- Optimized Query.clone() for non-combined queries.Keryn Knight
This avoids constructing a generator expression and a new tuple if the Query has no combined queries.
2021-09-17Refs #27624 -- Changed Query.explain_info to namedtuple.Adam Johnson
2021-09-17Optimized Query.clone() a bit.Adam Johnson
This removes unnecessary "if ... is None" branches, which are already shallow-copied in the __dict__.copy() call.
2021-09-01Fixed #33073 -- Fixed queryset crash with aggregation and empty/extra ↵David Wobrock
queryset annotation.
2021-08-19Fixed #33025 -- Avoided accessing the database connections in ↵Keryn Knight
Query.build_lookup() when not necessary. Of the built-in backends, only Oracle treats empty strings and nulls as equal, so avoid testing the default connection backend for interprets_empty_strings_as_nulls if it can be established from the lookup that it wouldn't affect the lookup instance returned. This improves performance a small amount for most lookups being built, because accessing the connections requires touching the thread critical `Local` which is an expensive operation.
2021-07-28Refs #32946 -- Changed Query.add_filter() to take two arguments.Keryn Knight
2021-07-22Fixed #32951 -- Removed Query.where_class & co.Nick Pope
Unused since 3caf957ed5eaa831a485abcb89f27266dbf3e82b.
2021-07-20Fixed #32704 -- Fixed list of deferred fields when chaining QuerySet.defer() ↵David Wobrock
after only().
2021-07-20Fixed #32944 -- Avoided unnecessary WhereNode.add() calls.Keryn Knight
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-07-15Refs #32508 -- Raised Type/ValueError instead of using "assert" in ↵Daniyal
django.db.models. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-07-09Fixed #27021 -- Allowed lookup expressions in annotations, aggregations, and ↵Ian Foote
QuerySet.filter(). Thanks Hannes Ljungberg and Simon Charette for reviews. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-07-02Refs #26430 -- Re-introduced empty aggregation optimization.Simon Charette
The introduction of the Expression.empty_aggregate_value interface allows the compilation stage to enable the EmptyResultSet optimization if all the aggregates expressions implement it. This also removes unnecessary RegrCount/Count.convert_value() methods. Disabling the empty result set aggregation optimization when it wasn't appropriate prevented None returned for a Count aggregation value. Thanks Nick Pope for the review.
2021-07-02Fixed #26430 -- Fixed coalesced aggregation of empty result sets.Simon Charette
Disable the EmptyResultSet optimization when performing aggregation as it might interfere with coalescence.
2021-06-30Fixed #32786 -- Moved subquery ordering clearing optimization to the _in lookup.Hannes Ljungberg
Co-Authored-By: Simon Charette <charette.s@gmail.com>
2021-06-30Refs #32786 -- Made Query.clear_ordering() not to cause side effects by default.Hannes Ljungberg
2021-04-28Removed unnecessary reuse_with_filtered_relation argument from Query methods.Nick Pope
In Query.join() the argument reuse_with_filtered_relation was used to determine whether to use == or .equals(). As this area of code is related to aliases, we only expect an instance of Join or BaseTable to be provided - the only two classes that provide .equals(). In both cases, the implementations of __eq__() and equals() are based on use of the "identity" property. __eq__() performs an isinstance() check first, returning NotImplemented if required. BaseTable.equals() then does a straightforward equality check on "identity". Join.equals() is a little bit different as it skips checking the last element of the "identity" property: filtered_relation. This was only included previously when the with_filtered_relation argument was True, impossible since bbf141bcdc31f1324048af9233583a523ac54c94.
2021-04-28Removed unused with_filtered_relation argument from .equals()Nick Pope
Unused since bbf141bcdc31f1324048af9233583a523ac54c94.
2021-04-28Fixed #32632, Fixed #32657 -- Removed flawed support for Subquery ↵Simon Charette
deconstruction. Subquery deconstruction support required implementing complex and expensive equality rules for sql.Query objects for little benefit as the latter cannot themselves be made deconstructible to their reference to model classes. Making Expression @deconstructible and not BaseExpression allows interested parties to conform to the "expression" API even if they are not deconstructible as it's only a requirement for expressions allowed in Model fields and meta options (e.g. constraints, indexes). Thanks Phillip Cutter for the report. This also fixes a performance regression in bbf141bcdc31f1324048af9233583a523ac54c94.
2021-04-21Fixed #32650 -- Fixed handling subquery aliasing on queryset combination.Simon Charette
This issue started manifesting itself when nesting a combined subquery relying on exclude() since 8593e162c9cb63a6c0b06daf045bc1c21eb4d7c1 but sql.Query.combine never properly handled subqueries outer refs in the first place, see QuerySetBitwiseOperationTests.test_subquery_aliases() (refs #27149). Thanks Raffaele Salmaso for the report.
2021-03-10Refs #32508 -- Raised TypeError instead of using "assert" on unsupported ↵Mariusz Felisiak
operations for sliced querysets.
2021-02-24Fixed #32478 -- Included nested columns referenced by subqueries in GROUP BY ↵Simon Charette
on aggregations. Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80. Refs #31094, #31150. Thanks Igor Pejic for the report.
2021-01-14Refs #7098 -- Removed support for passing raw column aliases to order_by().Mariusz Felisiak
Per deprecation timeline.
2021-01-14Refs #30158 -- Made alias argument required in signature of ↵Mariusz Felisiak
Expression.get_group_by_cols() subclasses. Per deprecation timeline.
2021-01-05Fixed #32231 -- Allowed passing None params to QuerySet.raw().Alexander Lyabah
2020-11-27Fixed #25534, Fixed #31639 -- Added support for transform references in ↵Ian Foote
expressions. Thanks Mariusz Felisiak and Simon Charette for reviews.
2020-11-16Fixed #31507 -- Added QuerySet.exists() optimizations to compound queries.David-Wobrock
2020-11-14Fixed #31496 -- Fixed QuerySet.values()/values_list() crash on combined ↵David-Wobrock
querysets ordered by annotations.
2020-11-04Fixed #31910 -- Fixed crash of GIS aggregations over subqueries.Simon Charette
Regression was introduced by fff5186 but was due a long standing issue. AggregateQuery was abusing Query.subquery: bool by stashing its compiled inner query's SQL for later use in its compiler which made select_format checks for Query.subquery wrongly assume the provide query was a subquery. This patch prevents that from happening by using a dedicated inner_query attribute which is compiled at a later time by SQLAggregateCompiler. Moving the inner query's compilation to SQLAggregateCompiler.compile had the side effect of addressing a long standing issue with aggregation subquery pushdown which prevented converters from being run. This is now fixed as the aggregation_regress adjustments demonstrate. Refs #25367. Thanks Eran Keydar for the report.
2020-10-29Fixed #32152 -- Fixed grouping by subquery aliases.Christian Klus
Regression in 42c08ee46539ef44f8658ebb1cbefb408e0d03fe. Thanks Simon Charette for the review.
2020-10-28Fixed #32143 -- Used EXISTS to exclude multi-valued relationships.Simon Charette
As mentioned in the pre-existing split_exclude() docstring EXISTS is easier to optimize for query planers and circumvents the IN (NULL) handling issue.
2020-10-28Refs #27149 -- Fixed sql.Query identity.Simon Charette
By making Query subclass BaseExpression in 35431298226165986ad07e91f9d3aca721ff38ec the former defined it's identity based off _construct_args which is not appropriate.
2020-10-23Fixed #32134 -- Fixed crash of __range lookup with namedtuple.Adam Johnson
Regression in 8be79984dce7d819879a6e594ca69c5f95a08378. Thanks Gordon Wrigley for the report.
2020-08-13Fixed #31792 -- Made Exists() reuse QuerySet.exists() optimizations.Simon Charette
The latter is already optimized to limit the number of results, avoid selecting unnecessary fields, and drop ordering if possible without altering the semantic of the query.
2020-07-31Fixed #27719 -- Added QuerySet.alias() to allow creating reusable aliases.Alexandr Tatarinov
QuerySet.alias() allows creating reusable aliases for expressions that don't need to be selected but are used for filtering, ordering, or as a part of complex expressions. Thanks Simon Charette for reviews.
2020-07-09Fixed #29789 -- Added support for nested relations to FilteredRelation.matt ferrante
2020-07-07Fixed #31767 -- Fixed QuerySet.none() on combined queryset.Mariusz Felisiak
2020-07-06Fixed #23797 -- Fixed QuerySet.exclude() when rhs is a nullable column.Jacob Walls
2020-06-08Fixed #31664 -- Reallowed using non-expressions having filterable attribute ↵Nicolas Baccelli
as rhs in queryset filters. Regression in 4edad1ddf6203326e0be4bdb105beecb0fe454c4.
2020-05-21Fixed #30375 -- Added FOR NO KEY UPDATE support to ↵Manuel Weitzman
QuerySet.select_for_update() on PostgreSQL.
2020-05-14Fixed #31568 -- Fixed alias reference when aggregating over multiple subqueries.Simon Charette
691def10a0197d83d2d108bd9043b0916d0f09b4 made all Subquery() instances equal to each other which broke aggregation subquery pushdown which relied on object equality to determine which alias it should select. Subquery.__eq__() will be fixed in an another commit but Query.rewrite_cols() should haved used object identity from the start. Refs #30727, #30188. Thanks Makina Corpus for the report.
2020-05-14Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() ↵Simon Charette
after annotate() with aggregations and subqueries. Subquery annotation references must be resolved if they are excluded from the GROUP BY clause by a following .values() call. Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80. Thanks Makina Corpus for the report.
2020-04-06Fixed #31426 -- Added proper field validation to QuerySet.order_by().Simon Charette
Resolve the field reference instead of using fragile regex based string reference validation.
generated by cgit v1.3 (git 2.53.0) at 2026-07-06 20:33:14 +0000