Commit Graph

442 Commits

Author SHA1 Message Date
Simon Charette 0bd57a879a [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec31970
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:36:17 +02:00
Christian Klus ab951d242e [3.1.x] Fixed #32152 -- Fixed grouping by subquery aliases.
Regression in 42c08ee465.

Thanks Simon Charette for the review.

Backport of 4ac2d4fa42 from master
2020-10-29 11:30:53 +01:00
Nicolas Baccelli 83749dca7a [3.1.x] Fixed #31664 -- Reallowed using non-expressions having filterable attribute as rhs in queryset filters.
Regression in 4edad1ddf6.

Backport of b38d44229f from master
2020-06-08 09:18:32 +02:00
Simon Charette 3913acdb29 [3.1.x] Fixed #31568 -- Fixed alias reference when aggregating over multiple subqueries.
691def10a0 made all Subquery() instances
equal to each other which broke aggregation subquery pushdown which
relied on object equality to determine which alias it should select.

Subquery.__eq__() will be fixed in an another commit but
Query.rewrite_cols() should haved used object identity from the start.

Refs #30727, #30188.

Thanks Makina Corpus for the report.

Backport of adfbf653dc from master
2020-05-14 10:26:05 +02:00
Simon Charette 8cb87a3f7c [3.1.x] Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() after annotate() with aggregations and subqueries.
Subquery annotation references must be resolved if they are excluded
from the GROUP BY clause by a following .values() call.

Regression in fb3f034f1c.

Thanks Makina Corpus for the report.

Backport of 42c08ee465 from master
2020-05-14 08:39:21 +02:00
Simon Charette 513948735b Fixed #31426 -- Added proper field validation to QuerySet.order_by().
Resolve the field reference instead of using fragile regex based string
reference validation.
2020-04-06 10:19:49 +02:00
Simon Charette 98ea4f0f46 Refs #7098 -- Deprecated passing raw column aliases to order_by().
Now that order_by() has expression support passing RawSQL() can achieve
the same result.

This was also already supported through QuerySet.extra(order_by) for
years but this API is more or less deprecated at this point.
2020-04-06 10:01:02 +02:00
Hasan Ramezani 4237050684 Fixed #31420 -- Fixed crash when filtering subquery annotation against a SimpleLazyObject.
Thanks Simon Charette for the solution and analysis.
2020-04-06 07:11:29 +02:00
Hasan Ramezani 10866a10fe Fixed #31377 -- Disabled grouping by aliases on QuerySet.values()/values_list() when they collide with field names.
Regression in fb3f034f1c.

Thanks Holovashchenko Vadym for the report.
2020-03-25 09:13:46 +01:00
Mariusz Felisiak 59b4e99dd0
Refs #31136 -- Made QuerySet.values()/values_list() group only by selected annotation.
Regression in 0f843fdd5b.
2020-01-15 09:32:42 +01:00
Mariusz Felisiak 0f843fdd5b
Fixed #31136 -- Disabled grouping by aliases on QuerySet.values()/values_list().
Regression in fb3f034f1c.

Thanks Sigurd Ljødal for the report.
2020-01-04 20:49:11 +01:00
Simon Charette 720de4d044 Fixed #31109 -- Disabled grouping by aliases on QuerySet.exists().
Clearing the SELECT clause in Query.has_results was orphaning GROUP BY
references to it.

Thanks Thierry Bastian for the report and Baptiste Mispelon for the
bisect.

Regression in fb3f034f1c.
2019-12-23 09:24:03 +01:00
Simon Charette 5a4d7285bd Fixed #31094 -- Included columns referenced by subqueries in GROUP BY on aggregations.
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-12-19 10:04:56 +01:00
Baptiste Mispelon 09341856ed Used Signature API instead of deprecated inspect.getcallargs().
inspect.getcallargs() was deprecated in Python 3.5 and the Signature
API (PEP 362) has better support for decorated functions (by default,
it follows the __wrapped__ attribute set by functools.wraps for
example).
2019-12-10 09:36:34 +01:00
Alex Aktsipetrov 723fc7fcf6 Made Query.check_filterable() use bool by default instead of str. 2019-12-06 13:52:36 +01:00
Alex Aktsipetrov bf12273db4 Fixed #31060 -- Reallowed window expressions to be used in conditions outside of queryset filters.
Regression in 4edad1ddf6.

Thanks utapyngo for the report.
2019-12-06 13:52:16 +01:00
Simon Charette f97a6123c0 Refs #25367 -- Made Query.build_filter() raise TypeError on non-conditional expressions. 2019-11-21 11:56:35 +01:00
Simon Charette e9a0e1d4f6 Fixed #30484 -- Added conditional expressions support to CheckConstraint. 2019-11-21 11:56:35 +01:00
Simon Charette 37e6c5b79b Refs #25367 -- Moved conditional expression wrapping to the Exact lookup. 2019-11-21 11:56:35 +01:00
Simon Charette 306b687520 Refs #11964 -- Removed SimpleCol in favor of Query(alias_cols).
This prevent having to pass simple_col through multiple function calls
by defining whether or not references should be resolved with aliases
at the Query level.
2019-11-21 11:56:35 +01:00
George Marshall 8be79984dc Fixed #30971 -- Prevented Query.resolve_lookup_value() from coercing list values to tuples.
Regression in 8a281aa7fe.
2019-11-13 08:27:26 +01:00
Simon Charette 37f8f29377 Fixed #30796 -- Prevented select_related() from mutating a queryset on chaining.
Thanks Darren Maki for the report.
2019-09-24 09:17:45 +02:00
Simon Charette 13a8884a08 Fixed #30739 -- Fixed exclusion of multi-valued lookup against outer rhs.
OuterRef right hand sides have to be nested, just like F rhs have to,
during the subquery pushdown split_exclude performs to ensure they are
resolved against the outer query aliases.
2019-09-02 10:52:36 +02:00
Matthew Schinckel 4137fc2efc Fixed #25367 -- Allowed boolean expressions in QuerySet.filter() and exclude().
This allows using expressions that have an output_field that is a
BooleanField to be used directly in a queryset filters, or in the
When() clauses of a Case() expression.

Thanks Josh Smeaton, Tim Graham, Simon Charette, Mariusz Felisiak, and
Adam Johnson for reviews.

Co-Authored-By: NyanKiyoshi <hello@vanille.bid>
2019-08-29 09:45:29 +02:00
Andrew Brown 8a281aa7fe Fixed #30687 -- Fixed using of OuterRef() expressions in distance lookups. 2019-08-16 06:50:33 +02:00
aaktsipetrov 4edad1ddf6 Fixed #30668 -- Made QuerySet.filter() raise NotSupportedError if any of source expressions is not filterable. 2019-08-02 15:06:00 +02:00
Mariusz Felisiak 806ba19bbf
Added Query.is_sliced property.
Previously, we used Query.can_filter() mainly to check if a query is
sliced what was confusing.
2019-07-25 20:45:55 +02:00
can f03b7bd114 Fixed #28408 -- Added error message when updating with annotated expressions on joined fields.
Co-Authored-By: Simon Charette <charette.s@gmail.com>
2019-06-28 07:55:32 +02:00
can 2cbd3967e0 Fixed #29834 -- Fixed column mismatch crash with QuerySet.values()/values_list() and order_by() on combined querysets. 2019-06-19 12:11:28 +02:00
Rob 6b736dd074 Fixed #30349 -- Fixed QuerySet.exclude() on FilteredRelation.
Using annotated FilteredRelations raised a FieldError when coupled with
exclude(). This is due to not passing filtered relation fields to the
subquery created in split_exclude(). We fixed this issue by passing the
filtered relation data to the newly created subquery.

Secondly, in the case where an INNER JOIN is used in the excluded
subquery, the ORM would trim the filtered relation INNER JOIN in attempt
to simplify the query. This will also remove the ON clause filters
generated by the FilteredRelation. We added logic to not trim the INNER
JOIN if it is from FilteredRelation.
2019-05-07 14:47:50 +02:00
can 719b746620 Fixed #30412 -- Fixed crash when adding check constraints with OR'ed condition on Oracle and SQLite. 2019-04-30 12:32:27 +02:00
Simon Charette 0cb4062482 Refs #23758 -- Used RecursionError instead of RuntimeError to raise nested subquery errors.
RecursionError was introduced in Python 3.5 and subclasses RuntimeError.
2019-04-15 15:20:41 +02:00
Simon Charette c0969ee227 Refs #27149 -- Based recursive nested subquery detection on sys.getrecursionlimit().
This makes sure the test_avoid_infinite_loop_on_too_many_subqueries test
doesn't fail on systems with a non-default recursion limit.
2019-04-15 15:20:41 +02:00
Simon Charette 1ca825e4dc Fixed #30246 -- Reused annotation aliases references in aggregation filters.
Thanks Jan Baryła for the detailed report and the reduced test case.
2019-03-23 10:11:45 -04:00
Simon Charette 3f32154f40 Refs #30188 -- Avoided GROUP BY when aggregating over non-aggregates. 2019-03-23 10:11:41 -04:00
Simon Charette d1e9c25162 Refs #30188 -- Prevented double annotation of subquery when aggregated over.
Thanks Can Sarıgöl for the suggested trimming approach.
2019-03-23 09:50:42 -04:00
Simon Charette bdc07f176e Fixed #30188 -- Fixed a crash when aggregating over a subquery annotation. 2019-03-23 09:48:31 -04:00
Simon Charette f19a4945e1 Fixed #21703 -- Fixed a crash when excluding a related field with a F(). 2019-03-23 09:48:28 -04:00
Simon Charette 5935a9aead Removed obsolete Lookup hook to prepare rhs expressions.
After 3a505c70e7, all _prepare() methods
return self.
2019-03-21 20:54:21 -04:00
Simon Charette 3a505c70e7 Refs #27149, #29542 -- Simplified subquery parentheses wrapping logic. 2019-03-21 20:42:26 -04:00
Simon Charette 3543129822 Refs #27149 -- Moved subquery expression resolving to Query.
This makes Subquery a thin wrapper over Query and makes sure it respects
the Expression source expression API by accepting the same number of
expressions as it returns. Refs #30188.

It also makes OuterRef usable in Query without Subquery wrapping. This
should allow Query's internals to more easily perform subquery push downs
during split_exclude(). Refs #21703.
2019-03-21 20:36:31 -04:00
Simon Charette 9dc367dc10 Refs #30158 -- Added alias argument to Expression.get_group_by_cols(). 2019-03-21 18:47:46 -04:00
Dan Davis 2bd8df243a Fixed #30184 -- Removed ellipsis characters from shell output strings.
Partially reverted 50b8493581 (refs #29654)
to avoid a crash when the user shell doesn't support non-ASCII characters.
2019-02-13 13:59:44 -05:00
Nick Pope 24b82cd201 Fixed #30159 -- Removed unneeded use of OrderedDict.
Dicts preserve order since Python 3.6.
2019-02-06 13:48:39 -05:00
Simon Charette 9e5e5a657b Fixed #30044 -- Raised a FieldError on inherited field update attempts. 2019-01-16 14:09:51 -05:00
Mariusz Felisiak d5f4ce9849
Fixed #29949 -- Refactored db introspection identifier converters.
Removed DatabaseIntrospection.table_name_converter()/column_name_converter()
and use instead DatabaseIntrospection.identifier_converter().

Removed DatabaseFeatures.uppercases_column_names.

Thanks Tim Graham for the initial patch and review and Simon Charette
for the review.
2018-11-21 09:06:50 +01:00
Jon Dufresne 2ba588e773 Refs #27795 -- Removed force_text() usage in db/models/sql/query.py. 2018-10-08 14:47:01 -04:00
Abhinav Patil bf01994a5c Fixed #29804 -- Added 'did you mean' suggestions for unsupported lookup error. 2018-10-01 19:03:10 -04:00
Sergey Fedoseev 8ef8bc0f64 Refs #28909 -- Simplifed code using unpacking generalizations. 2018-09-28 09:57:12 -04:00
Alexander Holmbäck f315d0423a Fixed #29727 -- Made nonexistent joins in F() raise FieldError.
Regression in 2162f0983d.
2018-09-08 09:40:33 -04:00