Commit Graph

4669 Commits

Author SHA1 Message Date
Simon Charette 0bd57a879a [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec31970
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:36:17 +02:00
Mariusz Felisiak b7d4a6fa65 [3.1.x] Fixed #32718 -- Relaxed file name validation in FileField.
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb3691.

Backport of b55699968f from main.
2021-05-13 08:56:06 +02:00
Florian Apolloner 25d84d6412 [3.1.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-04-27 19:12:15 +02:00
Mariusz Felisiak 9efe832ee1 [3.1.x] Fixed #32403 -- Fixed re-raising DatabaseErrors when using only 'postgres' database.
Thanks Kazantcev Andrey for the report.

Regression in f48f671223.
Backport of f131841c60 from master
2021-02-02 21:36:06 +01:00
sage a891e1bb0a [3.1.x] Fixed #32252 -- Fixed __isnull=True on key transforms on SQLite and Oracle.
__isnull=True on key transforms should not match keys with NULL values.

Backport of 8d7085e0fd from master
2020-12-11 11:18:15 +01:00
sage a7935fe942 [3.1.x] Fixed #32203 -- Fixed QuerySet.values()/values_list() crash on key transforms with non-string values on SQLite.
Thanks Gordon Wrigley for the report.

Backport of fe6e582421 from master
2020-11-25 20:30:38 +01:00
Mariusz Felisiak 97bfe0cba5 [3.1.x] Fixed #32224 -- Avoided suppressing connection errors in supports_json_field on SQLite.
Regression in 6789ded0a6.

Thanks Juan Garcia Alvite for the report.
Backport of f5e5aac59e from master
2020-11-25 12:21:29 +01:00
Hasan Ramezani 166c0d2474 [3.1.x] Fixed #32200 -- Fixed grouping by ExpressionWrapper() with Q objects.
Thanks Gordon Wrigley for the report.

Regression in df32fd42b8.

Backport of fe9c7ded29 from master
2020-11-19 21:42:14 +01:00
Hannes Ljungberg cc3870c30f [3.1.x] Fixed #32182 -- Fixed crash of JSONField nested key transforms with subquery annotations on PostgreSQL.
Backport of 0773837e15 from master
2020-11-10 08:13:03 +01:00
Christian Klus ab951d242e [3.1.x] Fixed #32152 -- Fixed grouping by subquery aliases.
Regression in 42c08ee465.

Thanks Simon Charette for the review.

Backport of 4ac2d4fa42 from master
2020-10-29 11:30:53 +01:00
Hasan Ramezani 2212927c1b [3.1.x] Fixed #32107 -- Fixed ProtectedError.protected_objects and RestrictedError.restricted_objects.
Regression in 4ca5c565f4 and
ab3cbd8b9a.

Thanks Vitaliy Yelnik for the report.

Backport of 3b1746d519 from master
2020-10-19 13:10:13 +02:00
Mariusz Felisiak be3ce38656 [3.1.x] Refs #32096 -- Made JSONField check respect Meta.required_db_vendor.
Thanks Simon Charette for the implementation idea.
Backport of 1fb97fb965 from master
2020-10-15 22:06:33 +02:00
Mariusz Felisiak ae6b24093c [3.1.x] Refs #32096 -- Fixed ExpressionWrapper crash with JSONField key transforms.
Regression in 6789ded0a6.

Thanks Simon Charette and Igor Jerosimić for the report.

Backport of bbd55e5863 from master
2020-10-14 21:03:40 +02:00
Mariusz Felisiak 59fe0b8541 [3.1.x] Refs #32096 -- Fixed __in lookup crash against key transforms for JSONField.
Regression in 6789ded0a6 and
1251772cb8.

Thanks Simon Charette and Igor Jerosimić for the report.

Backport of 7e1e198494 from master
2020-10-14 21:03:15 +02:00
David Smith 12ba61ed17 [3.1.x] Bumped minimum isort version to 5.1.0.
Fixed inner imports per isort 5.
isort 5.0.0 to 5.1.0 was unstable.

Backport of e74b3d724e from master
2020-09-30 09:51:31 +02:00
Mariusz Felisiak fbb7881956 [3.1.x] Fixed #32012 -- Made test database creation sync apps models when migrations are disabled.
Thanks Jaap Roes for the report.
Backport of 77caeaea88 from master
2020-09-23 10:54:50 +02:00
Mariusz Felisiak 1afc9b31bb [3.1.x] Fixed #32007 -- Fixed queryset crash with Q() annotation and aggregation.
Thanks Gordon Wrigley for the report.

Regression in 8a6df55f2d.
Backport of eaf9764d3b from master
2020-09-15 11:41:42 +02:00
Mariusz Felisiak a3bb80dc31 [3.1.x] Fixed #31990 -- Fixed QuerySet.ordered for GROUP BY queries on models with Meta.ordering.
Regression in 0ddb4ebf7b.

Thanks Julien Dutriaux for the report.
Backport of e11d05e0b4 from master
2020-09-14 20:08:18 +02:00
Brian Helba c69c6886de [3.1.x] Fixed #31941 -- Corrected FileField.deconstruct() with a callable storage.
Backport of 2d42e23b6d from master
2020-09-02 11:07:43 +02:00
Federico Jaramillo Martínez c4e5384e73 [3.1.x] Fixed #31952 -- Fixed EmptyFieldListFilter crash with reverse relationships.
Thanks dacotagh for the report.

Backport of 179d9dc0c2 from master
2020-08-31 10:40:21 +02:00
Simon Charette 2986ec031d [3.1.x] Fixed #31965 -- Adjusted multi-table fast-deletion on MySQL/MariaDB.
The optimization introduced in 7acef095d7 did not properly handle
deletion involving filters against aggregate annotations.

It initially was surfaced by a MariaDB test failure but misattributed
to an undocumented change in behavior that resulted in the systemic
generation of poorly performing database queries in 5b83bae031.

Thanks Anton Plotkin for the report.

Refs #23576.

Backport of f6405c0b8e from master
2020-08-31 09:22:59 +02:00
Mariusz Felisiak 655e1ce6b1 [3.1.x] Fixed #31956 -- Fixed crash of ordering by JSONField with a custom decoder on PostgreSQL.
Thanks Marc Debureaux for the report.
Thanks Simon Charette, Nick Pope, and Adam Johnson for reviews.

Backport of 0be51d2226 from master
2020-08-28 19:12:02 +02:00
Mariusz Felisiak 9075d1f662 [3.1.x] Fixed #31936 -- Fixed __in lookup on key transforms for JSONField.
This resolves an issue on databases without a native JSONField
(MariaDB, MySQL, SQLite, Oracle), where values must be wrapped.

Thanks Sébastien Pattyn for the report.
Backport of 1251772cb8 from master
2020-08-26 22:14:46 +02:00
Gert Burger 85c47b9a73 [3.1.x] Fixed #31863 -- Prevented mutating model state by copies of model instances.
Regression in bfb746f983.

Backport of 94ea79be13 from master
2020-08-13 15:27:18 +02:00
Daniel Hillier f139372491 [3.1.x] Fixed #31866 -- Fixed locking proxy models in QuerySet.select_for_update(of=()).
Backport of 60626162f7 from master
2020-08-11 12:30:31 +02:00
Tim Graham 32cb1fe1c6 [3.1.x] Refs #31829 -- Added DatabaseFeatures.json_key_contains_list_matching_requires_list.
CockroachDB's behavior matches PostgreSQL.
Backport of 184a6eebb0 from master
2020-07-30 06:40:32 +02:00
sage 23ce3d8491 [3.1.x] Fixed #31829 -- Used JSONField __contains lookup on key transforms.
Backport of 2d8dcba03a from master
2020-07-28 20:53:11 +02:00
Mariusz Felisiak 247bcef6b4 [3.1.x] Fixed #31836 -- Dropped support for JSONField __contains and __contained_by lookups on SQLite.
The current implementation works only for basic examples without
supporting nested structures and doesn't follow "the general principle
that the contained object must match the containing object as to
structure and data contents, possibly after discarding some
non-matching array elements or object key/value pairs from the
containing object".

Backport of ba691933ce from master.
2020-07-28 13:08:19 +02:00
Mariusz Felisiak 028a5f86f2 [3.1.x] Fixed #31835 -- Dropped support for JSONField __contains lookup on Oracle.
The current implementation works only for basic examples without
supporting nested structures and doesn't follow "the general principle
that the contained object must match the containing object as to
structure and data contents, possibly after discarding some
non-matching array elements or object key/value pairs from the
containing object".
Backport of 02447fb133 from master
2020-07-28 11:54:35 +02:00
Tim Graham d004bcee0c [3.1.x] Reverted "Fixed #30300 -- Allowed migrations to be loaded from directories without __init__.py file."
This reverts commit 3cd3bebe89.
Backport of ff55adbd0d from master
2020-07-22 07:04:52 +02:00
Mariusz Felisiak e6285cac83 [3.1.x] Fixed #31773 -- Fixed preserving output_field in ExpressionWrapper for combined expressions.
Thanks Thodoris Sotiropoulos for the report and Simon Charette for the
implementation idea.

Regression in df32fd42b8.
Backport of 8a6df55f2d from master
2020-07-09 11:55:45 +02:00
Mariusz Felisiak 3b5e307bbc [3.1.x] Fixed #31751 -- Fixed database introspection with cx_Oracle 8.
Backport of 615e32162f from master
2020-06-30 09:54:42 +02:00
Mariusz Felisiak 5263480d7f [3.1.x] Fixed #31742 -- Fixed makemigrations crash on ForeignKey to an app with mixed case label.
Regression in 9e1b6b8a66.

Thanks Ignacio Santolin for the report.
Backport of 62d85a2835 from master
2020-06-26 23:20:21 +02:00
Simon Charette b8cb14e8a0 [3.1.x] Fixed #31735 -- Fixed migrations crash on namespaced inline FK addition on PostgreSQL.
The namespace of the constraint must be included when making the
constraint immediate.

Regression in 22ce5d0031.

Thanks Rodrigo Estevao for the report.

Backport of 2e8941b6f9 from master
2020-06-24 08:59:43 +02:00
Mariusz Felisiak 42f5f2d76b [3.1.x] Fixed #31659 -- Made ExpressionWrapper preserve output_field for combined expressions.
Regression in df32fd42b8.

Thanks Simon Charette for the review.

Backport of aeb8996a67 from master
2020-06-12 07:21:19 +02:00
Hasan Ramezani 4385ef0119 [3.1.x] Fixed #31657 -- Fixed ordering by attnames of self-referential ForeignKeys.
Backport of 037a624120 from master
2020-06-10 12:05:31 +02:00
Nicolas Baccelli 83749dca7a [3.1.x] Fixed #31664 -- Reallowed using non-expressions having filterable attribute as rhs in queryset filters.
Regression in 4edad1ddf6.

Backport of b38d44229f from master
2020-06-08 09:18:32 +02:00
Mariusz Felisiak df9b9de6b0 [3.1.x] Fixed #31660 -- Fixed queryset crash when grouping by m2o relation.
Regression in 3a941230c8.

Thanks Tomasz Szymański for the report.
Backport of 78ad4b4b02 from master
2020-06-08 07:23:09 +02:00
Sasha Pachev 21adaffb6e [3.1.x] Fixed #31663 -- Made DecimalField.to_python() handle non-numeric invalid values.
Backport of 38a21f2d9e from master
2020-06-05 21:14:33 +02:00
Thodoris Sotiropoulos fdd2b01e8e [3.1.x] Fixed #31651 -- Made ExpressionWrapper use grouping columns from wrapped expression.
Backport of df32fd42b8 from master
2020-06-03 07:53:27 +02:00
Simon Charette aca675ad33 [3.1.x] Refs #21171 -- Made Collector.delete() rollback in the correct database.
Regression in c7dd8490b882b2cefdc7faf431dc64c532b79c9.
Backport of f8ef5f2c86 from master
2020-05-29 10:25:20 +02:00
Laurent Tramoy df88f24b1f [3.1.x] Fixed #31614 -- Fixed aliases ordering by OrderBy() expressions of combined queryset.
Backport of 2aac176e86 from master
2020-05-26 23:35:34 +02:00
Nan Liu 114da2d045 [3.1.x] Fixed #31416 -- Made autodetector find dependencies for MTI model creation on base fields removal.
Removing a base field must take place before adding a new inherited
model that has a field with the same name.

Backport of 33c365781a from master
2020-05-26 08:34:14 +02:00
Simon Charette d91095def4 [3.1.x] Fixed #31624 -- Avoided subquery usage on QuerySet.all().delete().
Thanks Adam Johnson for the report.

Regression in 7acef095d7.

Backport of 972000420e from master
2020-05-25 08:47:51 +02:00
Mariusz Felisiak 937314dc05 [3.1.x] Fixed #31607 -- Fixed evaluated Subquery equality.
Regression in 691def10a0.

Backport of a125da6a7c from master
2020-05-19 22:50:36 +02:00
Tim Graham 5480fab290 [3.1.x] Refs #12990 -- Added DatabaseFeatures.has_json_operators.
CockroachDB also has them.
Backport of f59a2b7306 from master
2020-05-18 08:12:57 +02:00
Mariusz Felisiak b46b0f80e8 [3.1.x] Fixed #31584 -- Fixed crash when chaining values()/values_list() after Exists() annotation and aggregation on Oracle.
Oracle requires the EXISTS expression to be wrapped in a CASE WHEN in
the GROUP BY clause.

Regression in efa1908f66.
Backport of 3a941230c8 from master
2020-05-14 15:10:28 +02:00
Simon Charette 3913acdb29 [3.1.x] Fixed #31568 -- Fixed alias reference when aggregating over multiple subqueries.
691def10a0 made all Subquery() instances
equal to each other which broke aggregation subquery pushdown which
relied on object equality to determine which alias it should select.

Subquery.__eq__() will be fixed in an another commit but
Query.rewrite_cols() should haved used object identity from the start.

Refs #30727, #30188.

Thanks Makina Corpus for the report.

Backport of adfbf653dc from master
2020-05-14 10:26:05 +02:00
Simon Charette 8cb87a3f7c [3.1.x] Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() after annotate() with aggregations and subqueries.
Subquery annotation references must be resolved if they are excluded
from the GROUP BY clause by a following .values() call.

Regression in fb3f034f1c.

Thanks Makina Corpus for the report.

Backport of 42c08ee465 from master
2020-05-14 08:39:21 +02:00
Jon Dufresne d6aff369ad Refs #30116 -- Simplified regex match group access with Match.__getitem__().
The method has been available since Python 3.6. The shorter syntax is
also marginally faster.
2020-05-11 12:01:28 +02:00