Ticket #19721: comma_in__in_data.patch

django/contrib/admin/util.py

@@ -2 +2 @@
 
 import datetime
 import decimal
+import re
 
 from django.db import models
 from django.db.models.constants import LOOKUP_SEP
@@ -36 +37 @@
     """
     # if key ends with __in, split parameter into separate values
     if key.endswith('__in'):
-        value = value.split(',')
+        # Use '\,' to escape ',', and '\\' to escape '\'
+        value = [re.sub(r"\\([\\,])", r"\1", v) for v in re.split(r'(?:(?<!\\)|(?<=\\\\)),', value)]
     # if key ends with __isnull, special case '' and false
     if key.endswith('__isnull'):
         if value.lower() in ('', 'false'):

tests/regressiontests/admin_filters/tests.py

@@ -163 +163 @@
         self.dev = Department.objects.create(code='DEV', description='Development')
         self.design = Department.objects.create(code='DSN', description='Design')
 
-        # Employees
-        self.john = Employee.objects.create(name='John Blue', department=self.dev)
-        self.jack = Employee.objects.create(name='Jack Red', department=self.design)
+        # Employees, with special characters in names. Refs #19721
+        self.john = Employee.objects.create(name='Red, John', department=self.dev)
+        self.jack = Employee.objects.create(name='Blue, Jack \\', department=self.design)
 
     def get_changelist(self, request, model, modeladmin):
         return ChangeList(request, model, modeladmin.list_display, modeladmin.list_display_links,
@@ -741 +741 @@
         self.assertEqual(choices[2]['display'], 'Design')
         self.assertEqual(choices[2]['selected'], False)
         self.assertEqual(choices[2]['query_string'], '?department__code__exact=DSN')
+
+    def test_comma_in___in_data(self):
+        """
+        Ensure that we can use values with ',' and '\\' with __in, by escaping
+        Refs #19721
+        """
+        modeladmin = EmployeeAdmin(Employee, site)
+
+        employees = [self.jack, self.john]
+
+        def quote(name):
+            return name.replace("\\", "\\\\").replace(",", "\\,")
+
+        request = self.request_factory.get('/', {'name__in': ",".join(quote(e.name) for e in employees)})
+
+        changelist = self.get_changelist(request, Employee, modeladmin)
+
+        # Make sure the correct queryset is returned
+        queryset = changelist.get_query_set(request)
+        self.assertEqual(list(queryset), employees)