summaryrefslogtreecommitdiff
path: root/django/db
AgeCommit message (Collapse)Author
2024-08-06[5.1.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection ↵Simon Charette
attacks against JSON fields. Thanks Eyal (eyalgabay) for the report.
2024-08-05[5.1.x] Fixed #35657 -- Made FileField handle db_default values.Sarah Boyce
Backport of 8deb6bb1fc427762d56646bf7306cbd11fb5bb68 from main.
2024-08-05[5.1.x] Fixed #35638 -- Updated validate_constraints to consider db_default.David Sanders
Backport of 509763c79952cde02d9f5b584af4278bdbed77b2 from main.
2024-08-05[5.1.x] Refs #35638 -- Avoided wrapping expressions with Value in ↵David Sanders
_get_field_value_map() and renamed to _get_field_expression_map(). Backport of 91a038754bb516d29cb79f0fed4025436b5c5346 from main.
2024-08-03[5.1.x] Fixed #35655 -- Reverted "Fixed #35295 -- Used INSERT with multiple ↵Sarah Boyce
rows on Oracle 23c." This reverts commit 175b04942afaff978013db61495f3b39ea12989b due to a crash when Oracle > 23.3. Backport of 5424151f96252e1289e9a6f7eb842cd1dc87850a from main.
2024-08-02[5.1.x] Fixed #35643 -- Fixed a crash when ordering a QuerySet by a ↵Simon Charette
reference containing "__". Regression in b0ad41198b3e333f57351e3fce5a1fb47f23f376. Refs #34013. The initial logic did not consider that annotation aliases can include lookup or transform separators. Thanks Gert Van Gool for the report and Mariusz Felisiak for the review. Backport of a16f13a8661297eda12c4177bb01fa2e5b5ccc56 from main.
2024-07-25[5.1.x] Fixed #35625 -- Fixed a crash when adding a field with db_default ↵Simon Charette
and check constraint. This is the exact same issue as refs #30408 but for creating a model with a constraint containing % escapes instead of column addition. All of these issues stem from a lack of SQL and parameters separation from the BaseConstraint DDL generating methods preventing them from being mixed with other parts of the schema alteration logic that do make use of parametrization on some backends (e.g. Postgres, MySQL for DEFAULT). Prior to the addition of Field.db_default and GeneratedField in 5.0 parametrization of DDL was never exercised on model creation so this is effectively a bug with db_default as the GeneratedField case was addressed by refs #35336. Thanks Julien Chaumont for the report and Mariusz Felisiak for the review. Backport of f359990e4909db8722820849d61a6f5724338723 from main.
2024-07-18[5.1.x] Fixed #35603 -- Prevented F.__contains__() from hanging.Simon Charette
Regression in 94b6f101f7dc363a8e71593570b17527dbb9f77f. Backport of 6b3f55446fdc62bd277903fd188a1781e4d92d29 from main.
2024-07-17[5.1.x] Fixed #35594 -- Added unique nulls distinct validation for expressions.Simon Charette
Thanks Mark Gensler for the report. Backport of adc0b6aac3f8a5c96e1ca282bc9f46e28d20281c from main.
2024-07-17[5.1.x] Refs #30581 -- Made unattached UniqueConstraint(fields) validation ↵Simon Charette
testable. The logic allowing UniqueConstraint(fields).validate to preserve backward compatiblity with Model.unique_error_message failed to account for cases where the constraint might not be attached to a model which is a common pattern during testing. This changes allows for arbitrary UniqueConstraint(fields) to be tested in isolation without requiring actual models backing them up. Co-authored-by: Mark G <mark.gensler@protonmail.com> Backport of 13922580cccfb9ab2922ff4943dd39da56dfbd8c from main.
2024-07-04[5.1.x] Fixed #35560 -- Made Model.full_clean() ignore GeneratedFields for ↵Mark Gensler
constraints. Accessing generated field values on unsaved models caused a crash when validating CheckConstraints and UniqueConstraints with expressions. Backport of 1005c2abd1ef0c156f449641e38c33e473989d37 from main.
2024-06-26[5.1.x] Fixed #35561 -- Made *args and **kwargs parsing more strict in ↵nessita
Model.save()/asave(). Backport of e56a32b89bb7fadffdfaa2cdf12b4863ccd5af9b from main.
2024-06-25[5.1.x] Fixed #35554, Refs #35060 -- Corrected deprecated *args parsing in ↵Adam Johnson
Model.save()/asave(). The transitional logic added to deprecate the usage of *args for Model.save()/asave() introduced two issues that this branch fixes: * Passing extra positional arguments no longer raised TypeError. * Passing a positional but empty update_fields would save all fields. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 28522c3c8d5eb581347aececc3ac61c134528114 from main.
2024-06-24[5.1.x] Fixed #35547 -- Added reset_queries to django.db.__all__.AjmalPonneth
Backport of 2a082d827de05528cb976109f219ec9b00490d2d from main.
2024-06-14[5.1.x] Fixed #34881 -- Fixed a crash when renaming a model with multiple ↵Anže Pečar
ManyToManyField.through references on SQLite. Thank you to dennisvang for the report and Jase Hackman for the test. Co-authored-by: Jase Hackman <jase.hackman@zapier.com> Backport of e99187e5c94516ee35f37cc41a36d906b395808d from main.
2024-06-14[5.1.x] Fixed #35469 -- Removed deferred SQL to create index removed by ↵Jacob Walls
AlterField operation. Backport of 99f23eaabd8da653f046dc1d19f5008c030a4f79 from main.
2024-05-22Fixed #35139 -- Prevented file read after ImageField is saved to storage.John Parton
2024-05-21Fixed #35405 -- Converted get_cache_name into a cached property in ↵Adam Johnson
FieldCacheMixin. FieldCacheMixin is used by related fields to track their cached values. This work migrates get_cache_name() to be a cached property to optimize performance by reducing unnecessary function calls when working with related fields, given that its value remains constant. Co-authored-by: Simon Charette <charette.s@gmail.com> Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-05-15Fixed #35384 -- Raised FieldError when saving a file without a name to ↵Jonny Park
FileField.
2024-05-14Fixed #35275 -- Fixed Meta.constraints validation crash on UniqueConstraint ↵Mariusz Felisiak
with OpClass(). This also introduces Expression.constraint_validation_compatible that allows specifying that expression should be ignored during a constraint validation.
2024-05-07Fixed #35407 -- Cached model's Options.swapped.Adam Johnson
2024-05-07Fixed #35425 -- Avoided INSERT with force_update and explicit pk.Jacob Walls
Affected models where the primary key field is defined with a default or db_default, such as UUIDField.
2024-05-03Fixed #35422 -- Fixed migrations crash when altering GeneratedField ↵Mariusz Felisiak
referencing rename field. Thanks Sarah Boyce for the report and Simon Charette for the implementation idea.
2024-05-02Fixed #35359 -- Fixed migration operations ordering when adding fields ↵DevilsAutumn
referenced by GeneratedField.expression. Thank you to Simon Charette for the review.
2024-05-02Refs #34007, Refs #35359 -- Added Q.referenced_based_fields property.David Sanders
Thank you to Mariusz Felisiak and Natalia Bidart for the reviews.
2024-04-29Fixed #35412 -- Dropped support for SQLite < 3.31.Mariusz Felisiak
2024-04-25Refs #35339 -- Updated Aggregate class to return consistent source expressions.Chris Muthig
Refactored the filter and order_by expressions in the Aggregate class to return a list of Expression (or None) values, ensuring that the list item is always available and represents the filter expression. For the PostgreSQL OrderableAggMixin, the returned list will always include the filter and the order_by value as the last two elements. Lastly, emtpy Q objects passed directly into aggregate objects using Aggregate.filter in admin facets are filtered out when resolving the expression to avoid errors in get_refs(). Thanks Simon Charette for the review.
2024-04-23Refs #35356 -- Clarified select related with masked field logic.Simon Charette
By always including related objects in the select mask via adjusting the defer logic (_get_defer_select_mask()), it becomes possible for select_related_descend() to treat forward and reverse relationships indistinctively. This work also simplifies and adds comments to select_related_descend() to make it easier to understand.
2024-04-23Fixed #35356 -- Deferred self-referential foreign key fields adequately.Simon Charette
While refs #34612 surfaced issues with reverse one-to-one fields deferrals, it missed that switching to storing remote fields would break self-referential relationships. This change switches to storing related objects in the select mask instead of remote fields to prevent collisions when dealing with self-referential relationships that might have a different directional mask. Despite fixing #21204 introduced a crash under some self-referential deferral conditions, it was simply not working even before that as it aggregated the sets of deferred fields by model. Thanks Joshua van Besouw for the report and Mariusz Felisiak for the review.
2024-04-22Fixed #35392, Refs #34331 -- Allowed importing aprefetch_related_objects ↵James Ostrander
from django.db.models. Thanks James Ostrander for the report and fix, and to Tim Graham and Mariusz Felisiak for the reviews.
2024-04-16Fixed #35373 -- Fixed a crash when indexing a generated field on SQLite.Simon Charette
Generated fields have to be excluded from the INSERT query against the remade table including the index. Thanks Moshe Dicker for the report, David Sanders and Mariusz Felisiak for the review.
2024-04-15Fixed ↵Mariusz Felisiak
backends.oracle.tests.TransactionalTests.test_hidden_no_data_found_exception() on oracledb >= 2.1.2. python-oracledb 2.1.2+ no longer hides 'ORA-1403: no data found' exceptions raised in database triggers: https://github.com/oracle/python-oracledb/issues/321
2024-04-10Fixed #35350 -- Fixed save() with pk set on models with GeneratedFields.Sarah Boyce
Thanks Matt Hegarty for the report and Simon Charette and Natalia Bidart for the reviews. Regression in f333e35.
2024-04-02Fixed #35336 -- Addressed crash when adding a GeneratedField with % literals.Simon Charette
A longer term solution is likely to have a better separation of parametrized DDL altogether to handle checks, constraints, defaults, and generated fields but such a change would require a significant refactor that isn't suitable for a backport. Thanks Adrian Garcia for the report.
2024-04-01Fixed #35344, Refs #34838 -- Corrected output_field of resolved columns for ↵Johannes Westphal
GeneratedFields in aliased tables. Thanks Simon Charette for the review.
2024-03-30Refs #35234 -- Skipped CheckConstraint system checks if not supported.Mariusz Felisiak
Thanks Tim Graham for the report. Regression in 0fb104dda287431f5ab74532e45e8471e22b58c8.
2024-03-26Fixed #35329 -- Fixed migrations crash when adding partial unique ↵Mariusz Felisiak
constraints with nulls_distinct. Bug in 595a2abb58e04caa4d55fb2589bb80fb2a8fdfa1. Thanks Lucas Lemke Saunitti for the report.
2024-03-25Removed unused _alter_column_collation_sql() in PostgreSQL DatabaseSchemaEditor.Mariusz Felisiak
Unused since ae0899be0d787fbfc5f5ab2b18c5a8219d822d2b.
2024-03-22Fixed #34841 -- Avoided rendering apps on state still requiring mutation.David Sanders
2024-03-21Fixed #35257 -- Corrected resolving output_field for ↵sharonwoo
IntegerField/DecimalField with NULL.
2024-03-20Fixed #35309 -- Made prefetch clear ordering for single-valued relationships.Laurent Lyaudet
2024-03-17Fixed #35301 -- Fixed Options._property_names for overriden properties.Adam Johnson
Regression in faeb92ea13f0c1b2cc83f45b512f2c41cfb4f02d.
2024-03-16Stopped skipping ↵Mariusz Felisiak
model_fields.test_jsonfield.TestQuerying.test_usage_in_subquery on Oracle 23c.
2024-03-15Refs #33996 -- Updated CheckConstraint validation on NULL values on Oracle 23c+.Mariusz Felisiak
Oracle 23c supports comparing boolean expressions.
2024-03-15Fixed #35294 -- Fixed TEXT format of QuerySet.explain() for long plans.Adam Johnson
co-authored-by: Gordon <gordon.wrigley@gmail.com> co-authored-by: Simon Charette <charette.s@gmail.com>
2024-03-14Fixed #28541 -- Fixed migrations crash when changing primary key on SQLite.Ben Cail
2024-03-14Fixed #35295 -- Used INSERT with multiple rows on Oracle 23c.Mariusz Felisiak
2024-03-14Refs #35295 -- Added BaseDatabaseOperations.bulk_insert_sql().Mariusz Felisiak
Co-authored-by: Nick Pope <nick@nickpope.me.uk>
2024-03-13Refs #32673, Refs #35295 -- Avoided wrapping rhs direct values in lookups.Mariusz Felisiak
2024-03-11Optimized DatabaseOperations.bulk_insert_sql() a bit on Oracle.Mariusz Felisiak