summaryrefslogtreecommitdiff
path: root/django/db/models/sql
AgeCommit message (Collapse)Author
2022-04-11[4.0.x] Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) ↵Mariusz Felisiak
against SQL injection on PostgreSQL. Backport of 6723a26e59b0b5429a0c5873941e01a2e1bdbb81 from main.
2022-04-11[4.0.x] Fixed CVE-2022-28346 -- Protected QuerySet.annotate(), aggregate(), ↵Mariusz Felisiak
and extra() against SQL injection in column aliases. Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report. Backport of 93cae5cb2f9a4ef1514cf1a41f714fef08005200 from main.
2022-03-30[4.0.x] Fixed #33598 -- Reverted "Removed unnecessary ↵Mariusz Felisiak
reuse_with_filtered_relation argument from Query methods." Thanks lind-marcus for the report. This reverts commit 0c71e0f9cfa714a22297ad31dd5613ee548db379. Regression in 0c71e0f9cfa714a22297ad31dd5613ee548db379. Backport of fac662f4798f7e4e0ed9be6b4fb4a87a80810a68 from main
2022-02-08[4.0.x] Refs #33476 -- Refactored code to strictly match 88 characters line ↵Mariusz Felisiak
length. Backport of 7119f40c9881666b6f9b5cf7df09ee1d21cc8344 from main.
2022-02-08[4.0.x] Refs #33476 -- Reformatted code with Black.django-bot
Backport of 9c19aff7c7561e3a82978a272ecdaad40dda5c00 from main.
2022-02-03[4.0.x] Refs #33476 -- Refactored problematic code before reformatting by Black.Mariusz Felisiak
In these cases Black produces unexpected results, e.g. def make_random_password( self, length=10, allowed_chars='abcdefghjkmnpqrstuvwxyz' 'ABCDEFGHJKLMNPQRSTUVWXYZ' '23456789', ): or cursor.execute(""" SELECT ... """, [table name], ) Backport of c5cd8783825b5f6384417dac5f3889b4210b7d08 from main.
2021-09-30[4.0.x] Fixed #33159 -- Reverted "Fixed #32970 -- Changed WhereNode.clone() ↵Mariusz Felisiak
to create a shallow copy of children." This reverts commit e441847ecae99dd1ccd0d9ce76dbcff51afa863c. A shallow copy is not enough because querysets can be reused and evaluated in nested nodes, which shouldn't mutate JOIN aliases. Thanks Michal Čihař for the report. Backport of 903aaa35e5ceaa33bfc9b19b7f6da65ce5a91dd4 from main
2021-09-29[4.0.x] Fixed #33018 -- Fixed annotations with empty queryset.David Wobrock
Thanks Simon Charette for the review and implementation idea. Backport of dd1fa3a31b4680c0d3712e6ae122b878138580c7 from main
2021-09-29[4.0.x] Fixed #33141 -- Renamed Expression.empty_aggregate_value to ↵David Wobrock
empty_result_set_value. Backport of ad36a198a12df4dff65992191b3eb0a474e2daac from main
2021-09-20Refs #27624 -- Optimized Query.clone() for non-combined queries.Keryn Knight
This avoids constructing a generator expression and a new tuple if the Query has no combined queries.
2021-09-20Fixed #32970 -- Changed WhereNode.clone() to create a shallow copy of children.Keryn Knight
2021-09-17Refs #27624 -- Changed Query.explain_info to namedtuple.Adam Johnson
2021-09-17Optimized Query.clone() a bit.Adam Johnson
This removes unnecessary "if ... is None" branches, which are already shallow-copied in the __dict__.copy() call.
2021-09-01Fixed #33073 -- Fixed queryset crash with aggregation and empty/extra ↵David Wobrock
queryset annotation.
2021-08-19Fixed #33025 -- Avoided accessing the database connections in ↵Keryn Knight
Query.build_lookup() when not necessary. Of the built-in backends, only Oracle treats empty strings and nulls as equal, so avoid testing the default connection backend for interprets_empty_strings_as_nulls if it can be established from the lookup that it wouldn't affect the lookup instance returned. This improves performance a small amount for most lookups being built, because accessing the connections requires touching the thread critical `Local` which is an expensive operation.
2021-08-09Removed unnecessary WhereNode.is_summary.Mariusz Felisiak
Unnecessary since its introduction in 1df89a60c5b7a28d7fda4c9ba7c07f02fd7de0fa.
2021-07-28Refs #32946 -- Changed Query.add_filter() to take two arguments.Keryn Knight
2021-07-22Fixed #32951 -- Removed Query.where_class & co.Nick Pope
Unused since 3caf957ed5eaa831a485abcb89f27266dbf3e82b.
2021-07-20Fixed #32704 -- Fixed list of deferred fields when chaining QuerySet.defer() ↵David Wobrock
after only().
2021-07-20Fixed #32944 -- Avoided unnecessary WhereNode.add() calls.Keryn Knight
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-07-16Prevented SQLCompiler.execute_sql() from closing cursor twice.Nick Pope
cursor_iter() helper calls cursor.close() in a finally block.
2021-07-15Refs #32508 -- Raised Type/ValueError instead of using "assert" in ↵Daniyal
django.db.models. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-07-09Fixed #27021 -- Allowed lookup expressions in annotations, aggregations, and ↵Ian Foote
QuerySet.filter(). Thanks Hannes Ljungberg and Simon Charette for reviews. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-07-05Fixed #32226 -- Fixed JSON format of QuerySet.explain() on PostgreSQL.Wu Haotian
2021-07-02Refs #26430 -- Re-introduced empty aggregation optimization.Simon Charette
The introduction of the Expression.empty_aggregate_value interface allows the compilation stage to enable the EmptyResultSet optimization if all the aggregates expressions implement it. This also removes unnecessary RegrCount/Count.convert_value() methods. Disabling the empty result set aggregation optimization when it wasn't appropriate prevented None returned for a Count aggregation value. Thanks Nick Pope for the review.
2021-07-02Fixed #26430 -- Fixed coalesced aggregation of empty result sets.Simon Charette
Disable the EmptyResultSet optimization when performing aggregation as it might interfere with coalescence.
2021-06-30Fixed #32786 -- Moved subquery ordering clearing optimization to the _in lookup.Hannes Ljungberg
Co-Authored-By: Simon Charette <charette.s@gmail.com>
2021-06-30Refs #32786 -- Made Query.clear_ordering() not to cause side effects by default.Hannes Ljungberg
2021-05-04Fixed #32693 -- Quoted and lowercased generated column aliases.Hasan Ramezani
2021-04-28Removed unnecessary reuse_with_filtered_relation argument from Query methods.Nick Pope
In Query.join() the argument reuse_with_filtered_relation was used to determine whether to use == or .equals(). As this area of code is related to aliases, we only expect an instance of Join or BaseTable to be provided - the only two classes that provide .equals(). In both cases, the implementations of __eq__() and equals() are based on use of the "identity" property. __eq__() performs an isinstance() check first, returning NotImplemented if required. BaseTable.equals() then does a straightforward equality check on "identity". Join.equals() is a little bit different as it skips checking the last element of the "identity" property: filtered_relation. This was only included previously when the with_filtered_relation argument was True, impossible since bbf141bcdc31f1324048af9233583a523ac54c94.
2021-04-28Removed unused with_filtered_relation argument from .equals()Nick Pope
Unused since bbf141bcdc31f1324048af9233583a523ac54c94.
2021-04-28Fixed #32632, Fixed #32657 -- Removed flawed support for Subquery ↵Simon Charette
deconstruction. Subquery deconstruction support required implementing complex and expensive equality rules for sql.Query objects for little benefit as the latter cannot themselves be made deconstructible to their reference to model classes. Making Expression @deconstructible and not BaseExpression allows interested parties to conform to the "expression" API even if they are not deconstructible as it's only a requirement for expressions allowed in Model fields and meta options (e.g. constraints, indexes). Thanks Phillip Cutter for the report. This also fixes a performance regression in bbf141bcdc31f1324048af9233583a523ac54c94.
2021-04-27Refs #32682 -- Fixed QuerySet.delete() crash on querysets with ↵Mariusz Felisiak
self-referential subqueries on MySQL.
2021-04-21Fixed #32662 -- Refactored a generator out of SQLCompiler.get_order_by().Chris Jerdonek
This also renames the `asc` variable to `default_order`, markes the `desc` variable as unused, fixes a typo in SQLCompiler.get_order_by() docstring, and reorders some blocks in SQLCompiler._order_by_pairs().
2021-04-21Fixed #32650 -- Fixed handling subquery aliasing on queryset combination.Simon Charette
This issue started manifesting itself when nesting a combined subquery relying on exclude() since 8593e162c9cb63a6c0b06daf045bc1c21eb4d7c1 but sql.Query.combine never properly handled subqueries outer refs in the first place, see QuerySetBitwiseOperationTests.test_subquery_aliases() (refs #27149). Thanks Raffaele Salmaso for the report.
2021-04-12Fixed #32627 -- Fixed QuerySet.values()/values_list() crash on combined ↵Iuri de Silvio
querysets ordered by unannotated columns.
2021-04-07Fixed #32442 -- Used converters on returning fields from INSERT statements.Adam Johnson
2021-03-16Fixed #32546 -- Avoided Meta.ordering columns in GROUP BY clauses.Yuri Konotopov
Follow up to 0ddb4ebf7bfcc4730c80a772dd146a49ef6895f6.
2021-03-10Refs #32508 -- Raised TypeError instead of using "assert" on unsupported ↵Mariusz Felisiak
operations for sliced querysets.
2021-02-24Fixed #32478 -- Included nested columns referenced by subqueries in GROUP BY ↵Simon Charette
on aggregations. Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80. Refs #31094, #31150. Thanks Igor Pejic for the report.
2021-01-14Refs #7098 -- Removed support for passing raw column aliases to order_by().Mariusz Felisiak
Per deprecation timeline.
2021-01-14Refs #30158 -- Made alias argument required in signature of ↵Mariusz Felisiak
Expression.get_group_by_cols() subclasses. Per deprecation timeline.
2021-01-05Fixed #32231 -- Allowed passing None params to QuerySet.raw().Alexander Lyabah
2020-11-27Fixed #25534, Fixed #31639 -- Added support for transform references in ↵Ian Foote
expressions. Thanks Mariusz Felisiak and Simon Charette for reviews.
2020-11-16Fixed #31507 -- Added QuerySet.exists() optimizations to compound queries.David-Wobrock
2020-11-14Fixed #31496 -- Fixed QuerySet.values()/values_list() crash on combined ↵David-Wobrock
querysets ordered by annotations.
2020-11-04Fixed #31910 -- Fixed crash of GIS aggregations over subqueries.Simon Charette
Regression was introduced by fff5186 but was due a long standing issue. AggregateQuery was abusing Query.subquery: bool by stashing its compiled inner query's SQL for later use in its compiler which made select_format checks for Query.subquery wrongly assume the provide query was a subquery. This patch prevents that from happening by using a dedicated inner_query attribute which is compiled at a later time by SQLAggregateCompiler. Moving the inner query's compilation to SQLAggregateCompiler.compile had the side effect of addressing a long standing issue with aggregation subquery pushdown which prevented converters from being run. This is now fixed as the aggregation_regress adjustments demonstrate. Refs #25367. Thanks Eran Keydar for the report.
2020-10-29Fixed #32152 -- Fixed grouping by subquery aliases.Christian Klus
Regression in 42c08ee46539ef44f8658ebb1cbefb408e0d03fe. Thanks Simon Charette for the review.
2020-10-28Fixed #32143 -- Used EXISTS to exclude multi-valued relationships.Simon Charette
As mentioned in the pre-existing split_exclude() docstring EXISTS is easier to optimize for query planers and circumvents the IN (NULL) handling issue.
2020-10-28Refs #27149 -- Fixed sql.Query identity.Simon Charette
By making Query subclass BaseExpression in 35431298226165986ad07e91f9d3aca721ff38ec the former defined it's identity based off _construct_args which is not appropriate.
generated by cgit v1.3 (git 2.53.0) at 2026-07-06 18:39:40 +0000