mirror of
https://github.com/django/django.git
synced 2025-11-25 05:04:26 +00:00
Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74.
Refs #28900.
Thanks Jeff Iadarola for the report and tests.
Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
This commit is contained in:
parent
25f97e7bcf
commit
12b771a1ec
3 changed files with 9 additions and 1 deletions
|
|
@ -1221,7 +1221,7 @@ class Query(BaseExpression):
|
|||
else:
|
||||
self.set_annotation_mask(set(self.annotation_select).difference({alias}))
|
||||
self.annotations[alias] = annotation
|
||||
if self.selected:
|
||||
if select and self.selected:
|
||||
self.selected[alias] = alias
|
||||
|
||||
@property
|
||||
|
|
|
|||
|
|
@ -19,3 +19,7 @@ Bugfixes
|
|||
* Fixed a regression in Django 5.2 that caused a crash of
|
||||
``QuerySet.bulk_create()`` with nullable geometry fields on PostGIS
|
||||
(:ticket:`36289`).
|
||||
|
||||
* Fixed a regression in Django 5.2 that caused fields to be incorrectly
|
||||
selected when using ``QuerySet.alias()`` after ``values()``
|
||||
(:ticket:`36299`).
|
||||
|
|
|
|||
|
|
@ -1470,6 +1470,10 @@ class AliasTests(TestCase):
|
|||
with self.assertRaisesMessage(FieldError, msg):
|
||||
getattr(qs, operation)("rating_alias")
|
||||
|
||||
def test_alias_after_values(self):
|
||||
qs = Book.objects.values_list("pk").alias(other_pk=F("pk"))
|
||||
self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,))
|
||||
|
||||
def test_alias_sql_injection(self):
|
||||
crafted_alias = """injected_name" from "annotations_book"; --"""
|
||||
msg = (
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue