Fixed #28222 -- Allowed settable properties in QuerySet.update_or_create()/get_or_create() defaults.

2 files changed, 4 insertions, 5 deletions

diff --git a/django/db/models/options.py b/django/db/models/options.py
index cd50ff0aaa..557455c128 100644
--- a/django/db/models/options.py
+++ b/django/db/models/options.py
@@ -828,10 +828,7 @@ class Options:
 
     @cached_property
     def _property_names(self):
-        """
-        Return a set of the names of the properties defined on the model.
-        Internal helper for model initialization.
-        """
+        """Return a set of the names of the properties defined on the model."""
         return frozenset({
             attr for attr in
             dir(self.model) if isinstance(getattr(self.model, attr), property)
diff --git a/django/db/models/query.py b/django/db/models/query.py
index 9fd116c4a6..10952195db 100644
--- a/django/db/models/query.py
+++ b/django/db/models/query.py
@@ -504,12 +504,14 @@ class QuerySet:
                 lookup[f.name] = lookup.pop(f.attname)
         params = {k: v for k, v in kwargs.items() if LOOKUP_SEP not in k}
         params.update(defaults)
+        property_names = self.model._meta._property_names
         invalid_params = []
         for param in params:
             try:
                 self.model._meta.get_field(param)
             except exceptions.FieldDoesNotExist:
-                if param != 'pk':  # It's okay to use a model's pk property.
+                # It's okay to use a model's property if it has a setter.
+                if not (param in property_names and getattr(self.model, param).fset):
                     invalid_params.append(param)
         if invalid_params:
             raise exceptions.FieldError(