mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

Fixed DoS possibility in ModelMultipleChoiceField.

Browse Source 
This is a security fix. Disclosure following shortly.

Thanks Keryn Knight for the report and initial patch.
This commit is contained in:
Tim Graham
2014-12-11 08:31:03 -05:00
parent a3bebfdc34
commit baf2542c4f
5 changed files with 63 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tests/model_forms/tests.py
View File

@@ -1635,6 +1635,27 @@ class ModelMultipleChoiceFieldTests(TestCase):
with self.assertNumQueries(1):
template.render(Context({'field': field}))
def test_show_hidden_initial_changed_queries_efficiently(self):
class WriterForm(forms.Form):
persons = forms.ModelMultipleChoiceField(
show_hidden_initial=True, queryset=Writer.objects.all())
writers = (Writer.objects.create(name=str(x)) for x in range(0, 50))
writer_pks = tuple(x.pk for x in writers)
form = WriterForm(data={'initial-persons': writer_pks})
with self.assertNumQueries(1):
self.assertTrue(form.has_changed())
def test_clean_does_deduplicate_values(self):
class WriterForm(forms.Form):
persons = forms.ModelMultipleChoiceField(queryset=Writer.objects.all())
person1 = Writer.objects.create(name="Person 1")
form = WriterForm(data={})
queryset = form.fields['persons'].clean([str(person1.pk)] * 50)
sql, params = queryset.query.sql_with_params()
self.assertEqual(len(params), 1)
class ModelOneToOneFieldTests(TestCase):
def test_modelform_onetoonefield(self):