mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-03 10:34:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[1.7.x] Fixed queries that may return unexpected results on MySQL due to typecasting.

Browse source 
This is a security fix. Disclosure will follow shortly.

Backport of 75c0d4ea3a from master
This commit is contained in:
Erik Romijn 2014-04-20 16:25:39 -04:00 • committed by Tim Graham
parent 380545bf85
commit 34526c2f56
6 changed files with 95 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/howto/custom-model-fields.txt
View file

@ -593,6 +593,17 @@ For example::
return ''.join([''.join(l) for l in (value.north,
value.east, value.south, value.west)])
.. warning::
If your custom field uses the ``CHAR``, ``VARCHAR`` or ``TEXT``
types for MySQL, you must make sure that :meth:`.get_prep_value`
always returns a string type. MySQL performs flexible and unexpected
matching when a query is performed on these types and the provided
value is an integer, which can cause queries to include unexpected
objects in their results. This problem cannot occur if you always
return a string type from :meth:`.get_prep_value`.
Converting query values to database values
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~