Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fixed related model lookup regression

It has been possible to use models of wrong type in related field
lookups. For example pigs__in=[a_duck] has worked. Changes to
ForeignObject broke that.

It might be a good idea to restrict the model types usable in lookups.
This should be done intentionally, not accidentally and without any
consideration for deprecation path.
  • Loading branch information...
commit 7cca8d56d28e321ffc395c92f82d97adaa0dcf94 1 parent 31fadc1
@akaariai akaariai authored
Showing with 17 additions and 1 deletion.
  1. +1 −1  django/db/models/fields/related.py
  2. +16 −0 tests/queries/tests.py
View
2  django/db/models/fields/related.py
@@ -1060,7 +1060,7 @@ def get_normalized_value(value):
value_list = []
for source in sources:
# Account for one-to-one relations when sent a different model
- while not isinstance(value, source.model):
+ while not isinstance(value, source.model) and source.rel:
source = source.rel.to._meta.get_field(source.rel.field_name)
value_list.append(getattr(value, source.attname))
return tuple(value_list)
View
16 tests/queries/tests.py
@@ -2939,3 +2939,19 @@ def test_ticket_20788(self):
chapter__paragraph__page=page)
self.assertQuerysetEqual(
sentences_not_in_pub, [book2], lambda x: x)
+
+class RelatedLookupTypeTests(TestCase):
+ def test_wrong_type_lookup(self):
+ oa = ObjectA.objects.create(name="oa")
+ wrong_type = Order.objects.create(id=oa.pk)
+ ob = ObjectB.objects.create(name="ob", objecta=oa, num=1)
+ # Currently Django doesn't care if the object is of correct
+ # type, it will just use the objecta's related fields attribute
+ # (id) for model lookup. Making things more restrictive could
+ # be a good idea...
+ self.assertQuerysetEqual(
+ ObjectB.objects.filter(objecta=wrong_type),
+ [ob], lambda x: x)
+ self.assertQuerysetEqual(
+ ObjectB.objects.filter(objecta__in=[wrong_type]),
+ [ob], lambda x: x)
Please sign in to comment.
Something went wrong with that request. Please try again.