django1/django/db/models/sql
Simon Charette 0bd57a879a [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec31970
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:36:17 +02:00
..
__init__.py Removed some outdated backwards compatibility imports and misleading comments. 2019-09-24 15:18:53 +02:00
compiler.py [3.1.x] Fixed #31965 -- Adjusted multi-table fast-deletion on MySQL/MariaDB. 2020-08-31 09:22:59 +02:00
constants.py [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by(). 2021-07-01 08:36:17 +02:00
datastructures.py Removed some outdated backwards compatibility imports and misleading comments. 2019-09-24 15:18:53 +02:00
query.py [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by(). 2021-07-01 08:36:17 +02:00
subqueries.py Fixed #31233 -- Closed database connections and cursors after use. 2020-02-06 15:35:23 +01:00
where.py [3.1.x] Fixed #32007 -- Fixed queryset crash with Q() annotation and aggregation. 2020-09-15 11:41:42 +02:00