Commit cdfdcf4b authored by Anubhav Joshi's avatar Anubhav Joshi Committed by Anssi Kääriäinen
Browse files

Fixed #23266 -- Prevented queries caused by type checking lookup values 

Small modifications done by committer.
parent f0b35888

django/db/models/sql/query.py

+13 −2
Original line number Diff line number Diff line
@@ -1104,6 +1104,17 @@ class Query(object): 
        if field.rel:

            # testing for iterable of models

            if hasattr(value, '__iter__'):

                # Check if the iterable has a model attribute, if so

                # it is likely something like a QuerySet.

                if hasattr(value, 'model') and hasattr(value.model, '_meta'):

                    model = value.model

                    if not (model == opts.concrete_model

                            or opts.concrete_model in model._meta.get_parent_list()

                            or model in opts.get_parent_list()):

                        raise ValueError(

                            'Cannot use QuerySet for "%s": Use a QuerySet for "%s".' %

                            (model._meta.model_name, opts.object_name))

                else:

                    for v in value:

                        self.check_query_object_type(v, opts)

            else:

tests/queries/tests.py

+4 −0
Original line number Diff line number Diff line
@@ -3461,6 +3461,10 @@ class RelatedLookupTypeTests(TestCase): 
        # parent objects

        self.assertQuerysetEqual(ObjectC.objects.exclude(childobjecta=self.oa), out_c)



        # Test for #23226

        with self.assertNumQueries(0):

            ObjectB.objects.filter(objecta__in=ObjectA.objects.all())





class Ticket14056Tests(TestCase):

    def test_ticket_14056(self):