Commit Graph

2697 Commits

Author SHA1 Message Date
Simon Charette 0bd57a879a [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec31970
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:36:17 +02:00
Mariusz Felisiak b7d4a6fa65 [3.1.x] Fixed #32718 -- Relaxed file name validation in FileField.
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb3691.

Backport of b55699968f from main.
2021-05-13 08:56:06 +02:00
Florian Apolloner 25d84d6412 [3.1.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-04-27 19:12:15 +02:00
sage a891e1bb0a [3.1.x] Fixed #32252 -- Fixed __isnull=True on key transforms on SQLite and Oracle.
__isnull=True on key transforms should not match keys with NULL values.

Backport of 8d7085e0fd from master
2020-12-11 11:18:15 +01:00
sage a7935fe942 [3.1.x] Fixed #32203 -- Fixed QuerySet.values()/values_list() crash on key transforms with non-string values on SQLite.
Thanks Gordon Wrigley for the report.

Backport of fe6e582421 from master
2020-11-25 20:30:38 +01:00
Hasan Ramezani 166c0d2474 [3.1.x] Fixed #32200 -- Fixed grouping by ExpressionWrapper() with Q objects.
Thanks Gordon Wrigley for the report.

Regression in df32fd42b8.

Backport of fe9c7ded29 from master
2020-11-19 21:42:14 +01:00
Hannes Ljungberg cc3870c30f [3.1.x] Fixed #32182 -- Fixed crash of JSONField nested key transforms with subquery annotations on PostgreSQL.
Backport of 0773837e15 from master
2020-11-10 08:13:03 +01:00
Christian Klus ab951d242e [3.1.x] Fixed #32152 -- Fixed grouping by subquery aliases.
Regression in 42c08ee465.

Thanks Simon Charette for the review.

Backport of 4ac2d4fa42 from master
2020-10-29 11:30:53 +01:00
Hasan Ramezani 2212927c1b [3.1.x] Fixed #32107 -- Fixed ProtectedError.protected_objects and RestrictedError.restricted_objects.
Regression in 4ca5c565f4 and
ab3cbd8b9a.

Thanks Vitaliy Yelnik for the report.

Backport of 3b1746d519 from master
2020-10-19 13:10:13 +02:00
Mariusz Felisiak be3ce38656 [3.1.x] Refs #32096 -- Made JSONField check respect Meta.required_db_vendor.
Thanks Simon Charette for the implementation idea.
Backport of 1fb97fb965 from master
2020-10-15 22:06:33 +02:00
Mariusz Felisiak ae6b24093c [3.1.x] Refs #32096 -- Fixed ExpressionWrapper crash with JSONField key transforms.
Regression in 6789ded0a6.

Thanks Simon Charette and Igor Jerosimić for the report.

Backport of bbd55e5863 from master
2020-10-14 21:03:40 +02:00
Mariusz Felisiak 59fe0b8541 [3.1.x] Refs #32096 -- Fixed __in lookup crash against key transforms for JSONField.
Regression in 6789ded0a6 and
1251772cb8.

Thanks Simon Charette and Igor Jerosimić for the report.

Backport of 7e1e198494 from master
2020-10-14 21:03:15 +02:00
David Smith 12ba61ed17 [3.1.x] Bumped minimum isort version to 5.1.0.
Fixed inner imports per isort 5.
isort 5.0.0 to 5.1.0 was unstable.

Backport of e74b3d724e from master
2020-09-30 09:51:31 +02:00
Mariusz Felisiak 1afc9b31bb [3.1.x] Fixed #32007 -- Fixed queryset crash with Q() annotation and aggregation.
Thanks Gordon Wrigley for the report.

Regression in 8a6df55f2d.
Backport of eaf9764d3b from master
2020-09-15 11:41:42 +02:00
Mariusz Felisiak a3bb80dc31 [3.1.x] Fixed #31990 -- Fixed QuerySet.ordered for GROUP BY queries on models with Meta.ordering.
Regression in 0ddb4ebf7b.

Thanks Julien Dutriaux for the report.
Backport of e11d05e0b4 from master
2020-09-14 20:08:18 +02:00
Brian Helba c69c6886de [3.1.x] Fixed #31941 -- Corrected FileField.deconstruct() with a callable storage.
Backport of 2d42e23b6d from master
2020-09-02 11:07:43 +02:00
Federico Jaramillo Martínez c4e5384e73 [3.1.x] Fixed #31952 -- Fixed EmptyFieldListFilter crash with reverse relationships.
Thanks dacotagh for the report.

Backport of 179d9dc0c2 from master
2020-08-31 10:40:21 +02:00
Simon Charette 2986ec031d [3.1.x] Fixed #31965 -- Adjusted multi-table fast-deletion on MySQL/MariaDB.
The optimization introduced in 7acef095d7 did not properly handle
deletion involving filters against aggregate annotations.

It initially was surfaced by a MariaDB test failure but misattributed
to an undocumented change in behavior that resulted in the systemic
generation of poorly performing database queries in 5b83bae031.

Thanks Anton Plotkin for the report.

Refs #23576.

Backport of f6405c0b8e from master
2020-08-31 09:22:59 +02:00
Mariusz Felisiak 655e1ce6b1 [3.1.x] Fixed #31956 -- Fixed crash of ordering by JSONField with a custom decoder on PostgreSQL.
Thanks Marc Debureaux for the report.
Thanks Simon Charette, Nick Pope, and Adam Johnson for reviews.

Backport of 0be51d2226 from master
2020-08-28 19:12:02 +02:00
Mariusz Felisiak 9075d1f662 [3.1.x] Fixed #31936 -- Fixed __in lookup on key transforms for JSONField.
This resolves an issue on databases without a native JSONField
(MariaDB, MySQL, SQLite, Oracle), where values must be wrapped.

Thanks Sébastien Pattyn for the report.
Backport of 1251772cb8 from master
2020-08-26 22:14:46 +02:00
Gert Burger 85c47b9a73 [3.1.x] Fixed #31863 -- Prevented mutating model state by copies of model instances.
Regression in bfb746f983.

Backport of 94ea79be13 from master
2020-08-13 15:27:18 +02:00
Daniel Hillier f139372491 [3.1.x] Fixed #31866 -- Fixed locking proxy models in QuerySet.select_for_update(of=()).
Backport of 60626162f7 from master
2020-08-11 12:30:31 +02:00
sage 23ce3d8491 [3.1.x] Fixed #31829 -- Used JSONField __contains lookup on key transforms.
Backport of 2d8dcba03a from master
2020-07-28 20:53:11 +02:00
Mariusz Felisiak 247bcef6b4 [3.1.x] Fixed #31836 -- Dropped support for JSONField __contains and __contained_by lookups on SQLite.
The current implementation works only for basic examples without
supporting nested structures and doesn't follow "the general principle
that the contained object must match the containing object as to
structure and data contents, possibly after discarding some
non-matching array elements or object key/value pairs from the
containing object".

Backport of ba691933ce from master.
2020-07-28 13:08:19 +02:00
Mariusz Felisiak 028a5f86f2 [3.1.x] Fixed #31835 -- Dropped support for JSONField __contains lookup on Oracle.
The current implementation works only for basic examples without
supporting nested structures and doesn't follow "the general principle
that the contained object must match the containing object as to
structure and data contents, possibly after discarding some
non-matching array elements or object key/value pairs from the
containing object".
Backport of 02447fb133 from master
2020-07-28 11:54:35 +02:00
Mariusz Felisiak e6285cac83 [3.1.x] Fixed #31773 -- Fixed preserving output_field in ExpressionWrapper for combined expressions.
Thanks Thodoris Sotiropoulos for the report and Simon Charette for the
implementation idea.

Regression in df32fd42b8.
Backport of 8a6df55f2d from master
2020-07-09 11:55:45 +02:00
Mariusz Felisiak 5263480d7f [3.1.x] Fixed #31742 -- Fixed makemigrations crash on ForeignKey to an app with mixed case label.
Regression in 9e1b6b8a66.

Thanks Ignacio Santolin for the report.
Backport of 62d85a2835 from master
2020-06-26 23:20:21 +02:00
Mariusz Felisiak 42f5f2d76b [3.1.x] Fixed #31659 -- Made ExpressionWrapper preserve output_field for combined expressions.
Regression in df32fd42b8.

Thanks Simon Charette for the review.

Backport of aeb8996a67 from master
2020-06-12 07:21:19 +02:00
Hasan Ramezani 4385ef0119 [3.1.x] Fixed #31657 -- Fixed ordering by attnames of self-referential ForeignKeys.
Backport of 037a624120 from master
2020-06-10 12:05:31 +02:00
Nicolas Baccelli 83749dca7a [3.1.x] Fixed #31664 -- Reallowed using non-expressions having filterable attribute as rhs in queryset filters.
Regression in 4edad1ddf6.

Backport of b38d44229f from master
2020-06-08 09:18:32 +02:00
Mariusz Felisiak df9b9de6b0 [3.1.x] Fixed #31660 -- Fixed queryset crash when grouping by m2o relation.
Regression in 3a941230c8.

Thanks Tomasz Szymański for the report.
Backport of 78ad4b4b02 from master
2020-06-08 07:23:09 +02:00
Sasha Pachev 21adaffb6e [3.1.x] Fixed #31663 -- Made DecimalField.to_python() handle non-numeric invalid values.
Backport of 38a21f2d9e from master
2020-06-05 21:14:33 +02:00
Thodoris Sotiropoulos fdd2b01e8e [3.1.x] Fixed #31651 -- Made ExpressionWrapper use grouping columns from wrapped expression.
Backport of df32fd42b8 from master
2020-06-03 07:53:27 +02:00
Simon Charette aca675ad33 [3.1.x] Refs #21171 -- Made Collector.delete() rollback in the correct database.
Regression in c7dd8490b882b2cefdc7faf431dc64c532b79c9.
Backport of f8ef5f2c86 from master
2020-05-29 10:25:20 +02:00
Laurent Tramoy df88f24b1f [3.1.x] Fixed #31614 -- Fixed aliases ordering by OrderBy() expressions of combined queryset.
Backport of 2aac176e86 from master
2020-05-26 23:35:34 +02:00
Simon Charette d91095def4 [3.1.x] Fixed #31624 -- Avoided subquery usage on QuerySet.all().delete().
Thanks Adam Johnson for the report.

Regression in 7acef095d7.

Backport of 972000420e from master
2020-05-25 08:47:51 +02:00
Mariusz Felisiak 937314dc05 [3.1.x] Fixed #31607 -- Fixed evaluated Subquery equality.
Regression in 691def10a0.

Backport of a125da6a7c from master
2020-05-19 22:50:36 +02:00
Mariusz Felisiak b46b0f80e8 [3.1.x] Fixed #31584 -- Fixed crash when chaining values()/values_list() after Exists() annotation and aggregation on Oracle.
Oracle requires the EXISTS expression to be wrapped in a CASE WHEN in
the GROUP BY clause.

Regression in efa1908f66.
Backport of 3a941230c8 from master
2020-05-14 15:10:28 +02:00
Simon Charette 3913acdb29 [3.1.x] Fixed #31568 -- Fixed alias reference when aggregating over multiple subqueries.
691def10a0 made all Subquery() instances
equal to each other which broke aggregation subquery pushdown which
relied on object equality to determine which alias it should select.

Subquery.__eq__() will be fixed in an another commit but
Query.rewrite_cols() should haved used object identity from the start.

Refs #30727, #30188.

Thanks Makina Corpus for the report.

Backport of adfbf653dc from master
2020-05-14 10:26:05 +02:00
Simon Charette 8cb87a3f7c [3.1.x] Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() after annotate() with aggregations and subqueries.
Subquery annotation references must be resolved if they are excluded
from the GROUP BY clause by a following .values() call.

Regression in fb3f034f1c.

Thanks Makina Corpus for the report.

Backport of 42c08ee465 from master
2020-05-14 08:39:21 +02:00
Jon Dufresne d6aff369ad Refs #30116 -- Simplified regex match group access with Match.__getitem__().
The method has been available since Python 3.6. The shorter syntax is
also marginally faster.
2020-05-11 12:01:28 +02:00
Adam Johnson a8b2db1cae Optimized Model and QuerySet pickling version comparison. 2020-05-11 09:50:11 +02:00
sage 6789ded0a6 Fixed #12990, Refs #27694 -- Added JSONField model field.
Thanks to Adam Johnson, Carlton Gibson, Mariusz Felisiak, and Raphael
Michel for mentoring this Google Summer of Code 2019 project and
everyone else who helped with the patch.

Special thanks to Mads Jensen, Nick Pope, and Simon Charette for
extensive reviews.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2020-05-08 07:23:31 +02:00
Mariusz Felisiak b73e66e758
Fixed #31538 -- Fixed Meta.ordering validation lookups that are not transforms.
Regression in 440505cb2c.

Thanks Simon Meers for the report.
2020-05-05 09:08:29 +02:00
Ian Foote c226c6cb32 Fixed #20581 -- Added support for deferrable unique constraints. 2020-04-30 10:43:50 +02:00
François Freitag abea86f9e4 Removed unnecessary tuple wrapping of single format string argument. 2020-04-27 08:30:16 +02:00
Tim Schilling a92cc84b4a Refs #31369 -- Deprecated models.NullBooleanField in favor of BooleanField(null=True). 2020-04-24 10:10:45 +02:00
Hannes Ljungberg 447980e72a Fixed #31500 -- Fixed detecting of unique fields in QuerySet.in_bulk() when using Meta.constraints.
Detection of unique fields now takes into account non-partial unique
constraints.
2020-04-23 08:07:08 +02:00
Adam Johnson 67f9d076cf
Avoided unnecessary recompilation of ordering clause regex in SQLCompiler. 2020-04-22 20:28:01 +02:00
Hasan Ramezani 35a67b3731 Fixed #31474 -- Made QuerySet.delete() not return the number of deleted objects if it's zero. 2020-04-20 09:51:54 +02:00