mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00
Code Issues 32 Releases Wiki Activity

[5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().

Browse Source 
Regression in 65ad4ade74.

Refs #28900.

Thanks Jeff Iadarola for the report and tests.

Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>

Backport of 12b771a1ec from main
This commit is contained in:
Simon Charette
2025-04-04 10:18:27 -04:00
committed by Mariusz Felisiak
parent d9bf0d07cc
commit cd1aa54f5a
3 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/annotations/tests.py
View File

@@ -1470,6 +1470,10 @@ class AliasTests(TestCase):
with self.assertRaisesMessage(FieldError, msg):
getattr(qs, operation)("rating_alias")
def test_alias_after_values(self):
qs = Book.objects.values_list("pk").alias(other_pk=F("pk"))
self.assertEqual(qs.get(pk=self.b1.pk), (self.b1.pk,))
def test_alias_sql_injection(self):
crafted_alias = """injected_name" from "annotations_book"; --"""
msg = (