mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

Refs CVE-2022-34265 -- Properly escaped Extract() and Trunc() parameters.

Browse Source 
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
This commit is contained in:
Simon Charette
2022-06-19 23:46:22 -04:00
committed by Mariusz Felisiak
parent 73766c1187
commit 877c800f25
10 changed files with 263 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tests/custom_lookups/tests.py
View File

@@ -75,7 +75,7 @@ class YearTransform(models.Transform):
def as_sql(self, compiler, connection):
lhs_sql, params = compiler.compile(self.lhs)
return connection.ops.date_extract_sql("year", lhs_sql), params
return connection.ops.date_extract_sql("year", lhs_sql, params)
@property
def output_field(self):