Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

[1.6.x] Fixed related model lookup regression

It has been possible to use models of wrong type in related field
lookups. For example pigs__in=[a_duck] has worked. Changes to
ForeignObject broke that.

It might be a good idea to restrict the model types usable in lookups.
This should be done intentionally, not accidentally and without any
consideration for deprecation path.

Backpatch of 7cca8d5 from master.
  • Loading branch information...
commit 7f892cedbad13b444151a1c163a328d968ee6b44 1 parent efdf744
Anssi Kääriäinen akaariai authored
Showing with 17 additions and 1 deletion.
  1. +1 −1  django/db/models/fields/related.py
  2. +16 −0 tests/queries/tests.py
2  django/db/models/fields/related.py
View
@@ -1060,7 +1060,7 @@ def get_normalized_value(value):
value_list = []
for source in sources:
# Account for one-to-one relations when sent a different model
- while not isinstance(value, source.model):
+ while not isinstance(value, source.model) and source.rel:
source = source.rel.to._meta.get_field(source.rel.field_name)
value_list.append(getattr(value, source.attname))
return tuple(value_list)
16 tests/queries/tests.py
View
@@ -2927,3 +2927,19 @@ def test_ticket_18785(self):
).order_by()
self.assertEqual(1, str(qs.query).count('INNER JOIN'))
self.assertEqual(0, str(qs.query).count('OUTER JOIN'))
+
+class RelatedLookupTypeTests(TestCase):
+ def test_wrong_type_lookup(self):
+ oa = ObjectA.objects.create(name="oa")
+ wrong_type = Order.objects.create(id=oa.pk)
+ ob = ObjectB.objects.create(name="ob", objecta=oa, num=1)
+ # Currently Django doesn't care if the object is of correct
+ # type, it will just use the objecta's related fields attribute
+ # (id) for model lookup. Making things more restrictive could
+ # be a good idea...
+ self.assertQuerysetEqual(
+ ObjectB.objects.filter(objecta=wrong_type),
+ [ob], lambda x: x)
+ self.assertQuerysetEqual(
+ ObjectB.objects.filter(objecta__in=[wrong_type]),
+ [ob], lambda x: x)
Please sign in to comment.
Something went wrong with that request. Please try again.