summaryrefslogtreecommitdiff
path: root/django/db/models/sql
AgeCommit message (Collapse)Author
2024-08-06[5.1.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection ↵Simon Charette
attacks against JSON fields. Thanks Eyal (eyalgabay) for the report.
2024-08-02[5.1.x] Fixed #35643 -- Fixed a crash when ordering a QuerySet by a ↵Simon Charette
reference containing "__". Regression in b0ad41198b3e333f57351e3fce5a1fb47f23f376. Refs #34013. The initial logic did not consider that annotation aliases can include lookup or transform separators. Thanks Gert Van Gool for the report and Mariusz Felisiak for the review. Backport of a16f13a8661297eda12c4177bb01fa2e5b5ccc56 from main.
2024-04-23Refs #35356 -- Clarified select related with masked field logic.Simon Charette
By always including related objects in the select mask via adjusting the defer logic (_get_defer_select_mask()), it becomes possible for select_related_descend() to treat forward and reverse relationships indistinctively. This work also simplifies and adds comments to select_related_descend() to make it easier to understand.
2024-04-23Fixed #35356 -- Deferred self-referential foreign key fields adequately.Simon Charette
While refs #34612 surfaced issues with reverse one-to-one fields deferrals, it missed that switching to storing remote fields would break self-referential relationships. This change switches to storing related objects in the select mask instead of remote fields to prevent collisions when dealing with self-referential relationships that might have a different directional mask. Despite fixing #21204 introduced a crash under some self-referential deferral conditions, it was simply not working even before that as it aggregated the sets of deferred fields by model. Thanks Joshua van Besouw for the report and Mariusz Felisiak for the review.
2024-03-15Fixed #35294 -- Fixed TEXT format of QuerySet.explain() for long plans.Adam Johnson
co-authored-by: Gordon <gordon.wrigley@gmail.com> co-authored-by: Simon Charette <charette.s@gmail.com>
2024-02-26Fixed #35241 -- Cached model's full parent list.Adam Johnson
co-authored-by: Keryn Knight <keryn@kerynknight.com> co-authored-by: Natalia <124304+nessita@users.noreply.github.com> co-authored-by: David Smith <smithdc@gmail.com> co-authored-by: Paolo Melchiorre <paolo@melchiorre.org>
2024-02-07Fixed #35099 -- Prevented mutating queryset when combining with & and | ↵Hisham Mahmood
operators. Thanks Alan for the report. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2024-01-29Fixed #35135 -- Made FilteredRelation raise ValueError on querysets as rhs.Nicolas Delaby
Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-15Refs #35102 -- Optimized replace_expressions()/relabelling aliases by adding ↵Mariusz Felisiak
early return. This avoids costly hashing. Thanks Anthony Shaw for the report. Co-Authored-By: Simon Charette <charette.s@gmail.com>
2023-12-23Fixed #35050 -- Fixed prefixing field names in FilteredRelation().David Wobrock
Thanks Mark Zorn for the report. Regression in 59f475470494ce5b8cbff816b1e5dafcbd10a3a3.
2023-12-16Fixed #35042 -- Fixed a count() crash on combined queries.Simon Charette
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Thanks Marcin for the report.
2023-12-12Fixed #34013 -- Added QuerySet.order_by() support for annotation transforms.Simon Charette
Thanks Eugene Morozov and Ben Nace for the reports.
2023-12-07Fixed #35024 -- Fixed model instance creation crash on ↵Mariusz Felisiak
GeneratedField.output_field with backend converters. Regression in d9de74141e8a920940f1b91ed0a3ccb835b55729. This is a long standing issue, however it caused a crash of GeneratedFields for all output fields that have backend-specific converters when the RETURNING clause is not supported (MySQL and SQLite < 3.35). That's why severity was exacerbated.
2023-11-18Refs #34717 -- Avoided computing aggregate refs twice.Simon Charette
2023-11-18Refs #34975 -- Complemented rhs filtering aggregations for __in lookup.Simon Charette
While this isn't a regression it's clear that similar logic should be applied when dealing with lists of expressions passed as a lookup value.
2023-11-18Fixed #34975 -- Fixed crash of conditional aggregate() over aggregations.Simon Charette
Adjustments made to solve_lookup_type to defer the resolving of references for summarized aggregates failed to account for similar requirements for lookup values which can also reference annotations through Aggregate.filter. Regression in b181cae2e3697b2e53b5b67ac67e59f3b05a6f0d. Refs #25307. Thanks Sergey Nesterenko for the report.
2023-11-13Fixed #34967 -- Fixed queryset crash when grouping by constants on SQLite < ↵David Sanders
3.39. On SQLite < 3.39, this forces a GROUP BY clause with a HAVING clause when no grouping is specified. Co-authored-by: Simon Charette <charette.s@gmail.com>
2023-10-16Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing ↵Simon Charette
expressions containing subqueries. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7, complements e5c844d6f2a4ac6ae674d741b5f1fa2a688cedf4. Refs #28477, #34551. Thanks Haldun Komsuoglu for the report.
2023-09-07Fixed #31300 -- Added GeneratedField model field.Jeremy Nauta
Thanks Adam Johnson and Paolo Melchiorre for reviews. Co-Authored-By: Lily Foote <code@lilyf.org> Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2023-08-11Fixed #34362 -- Fixed FilteredRelation() crash on conditional expressions.Francesco Panico
Thanks zhu for the report and Simon Charette for reviews.
2023-08-11Fixed #34743 -- Fixed Meta.constraints validation crash when using pk.Francesco Panico
Thanks Nwawel A Iroume for the report.
2023-08-02Removed unneeded escapes in regexes.Mariusz Felisiak
Special characters lose their special meaning inside sets of characters. "-" lose its special meaning if it's placed as the first or last character. Follow up to 7c6b66383da5f9a67142334cd2ed2d769739e8f1.
2023-08-01Fixed #34750 -- Fixed QuerySet.count() when grouping by unused multi-valued ↵Mariusz Felisiak
annotations. Thanks Toan Vuong for the report. Thanks Simon Charette for the review. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.
2023-07-21Refs #34362 -- Added get_child_with_renamed_prefix() hook.Francesco Panico
2023-07-19Fixed #34717 -- Fixed QuerySet.aggregate() crash when referencing window ↵Simon Charette
functions. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Refs #28477. Thanks younes-chaoui for the report.
2023-06-14Refs #32143 -- Removed superflous constraints on excluded query.Simon Charette
The outer query reference is not necessary when alias can be reused and can even be harmful by confusing query planers. Refs #34597.
2023-06-14Refs #32143 -- Adjusted a comment about subquery usage in Query.split_exclude().Simon Charette
2023-06-08Fixed #34604 -- Corrected fallback SQL for n-ary logical XOR.Anders Kaseorg
An n-ary logical XOR Q(…) ^ Q(…) ^ … ^ Q(…) should evaluate to true when an odd number of its operands evaluate to true, not when exactly one operand evaluates to true.
2023-06-01Fixed #34612 -- Fixed QuerySet.only() crash on reverse relationships.Simon Charette
Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879. Thanks Ian Cubitt for the report. This also corrected test_inheritance_deferred2() test which was previously properly defined and marked as an expected failure but was then wrongly adjusted to mask the lack of support for per-alias deferral that was fixed by #21204.
2023-05-23Fixed #34551 -- Fixed QuerySet.aggregate() crash when referencing subqueries.Simon Charette
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Refs #28477. Thanks Denis Roldán and Mariusz for the test.
2023-05-23Refs #34551 -- Fixed QuerySet.aggregate() crash on precending aggregation ↵Simon Charette
reference. Regression in 1297c0d0d76a708017fe196b61a0ab324df76954. Refs #31679.
2023-05-22Fixed #34580 -- Avoided unnecessary computation of selected expressions in ↵Simon Charette
SQLCompiler. Performance regression in 278881e37619278789942513916acafaa88d26f3. Co-authored-by: David Smith <smithdc@gmail.com>
2023-05-17Fixed #34570 -- Silenced noop deferral of many-to-many and GFK.Simon Charette
While deferring many-to-many and GFK has no effect, the previous implementation of QuerySet.defer() ignore them instead of crashing. Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879. Thanks Paco Martínez for the report.
2023-05-01Fixed #33759 -- Avoided unnecessary subquery in QuerySet.delete() with ↵4the4ryushin
self-referential subqueries if supported.
2023-04-24Refs #33766 -- Removed sql.Query.build_filtered_relation_q().Simon Charette
It was a copy of sql.Query._add_q that avoided JOIN updates.
2023-04-24Refs #33766 -- Removed unused Join.equals().Simon Charette
It's unused now that the specialized FilteredRelation.as_sql logic is no more.
2023-04-24Fixed #33766 -- Resolved FilteredRelation.condition at referencing time.Simon Charette
The previous implementation resolved condition at Join compilation time which required introducing a specialized expression resolving mode to alter the join reuse logic solely during that phase. FilteredRelation.condition is now resolved when the relation is first referenced which maintains the existing behavior while allowing the removal of the specialized resolving mode and address an issue where conditions couldn't spawn new joins.
2023-04-18Refs #16055 -- Deprecated ↵David Wobrock
get_joining_columns()/get_reverse_joining_columns() methods.
2023-04-18Fixed #16055 -- Fixed crash when filtering against char/text GenericRelation ↵David Wobrock
relation on PostgreSQL.
2023-04-07Fixed #34464 -- Fixed queryset aggregation over group by reference.Simon Charette
Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Refs #28477. Thanks Ian Cubitt for the report.
2023-04-05Fixed #34458 -- Fixed QuerySet.defer() crash on attribute names.Simon Charette
Thanks Andrew Cordery for the report. Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879.
2023-04-04Fixed #34450 -- Fixed multi-valued JOIN reuse when filtering by expressions.Simon Charette
Thanks Roman Odaisky for the report.
2023-03-28Refs #29799 -- Added field instance lookups to suggestions in FieldErrors.Mariusz Felisiak
Bug in cd1afd553f9c175ebccfc0f50e72b43b9604bd97.
2023-03-25Fixed #34437 -- Made values() resolving error mention selected annotations.Simon Charette
While the add_fields() call from set_values() does trigger validation it does so after annotations are masked resulting in them being excluded from the choices of valid options surfaced through a FieldError.
2023-03-24Fixed #28553 -- Fixed annotation mismatch with ↵David Wobrock
QuerySet.values()/values_list() on compound queries. Co-authored-by: Matthias Kestenholz <mk@feinheit.ch>
2023-03-20Fixed some typos in comments, docstrings, and tests.Liyang Zhang
2023-02-27Fixed #34368 -- Made subquery raise NotSupportedError when referencing outer ↵Simon Charette
window expression. Regression in f387d024fc75569d2a4a338bfda76cc2f328f627. Co-authored-by: Jannis Vajen <jvajen@gmail.com>
2023-02-27Fixed #34372 -- Fixed queryset crash on order by aggregation using OrderBy.Simon Charette
Regression in 278881e37619278789942513916acafaa88d26f3 caused by a lack of expression copying when an OrderBy expression is explicitly provided. Thanks Jannis Vajen for the report and regression test.
2023-02-20Fixed #34346 -- Ordered selected expressions by position.Simon Charette
Used the same approach as for #34176 by using selected expressions position to prevent ambiguous aliases in collisions. Thanks henribru for the report. Regression in 04518e310d4552ff7595a34f5a7f93487d78a406.
generated by cgit v1.3 (git 2.53.0) at 2026-07-05 14:30:47 +0000