Opened 3 weeks ago

Closed 3 weeks ago

#36683 closed Cleanup/optimization (fixed)

Update with Distinct Produces Unintentional Results

Reported by: Matt Shirley Owned by: Matt Shirley
Component: Database layer (models, ORM) Version: dev
Severity: Normal Keywords: orm, distinct, update
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

Similar to #32433.

The ORM permits calling update() on a Queryset when a distinct() was applied. This results in unforeseen consequences where a larger data set will be updated than what is expected. Similar to the example provided in #32433:

Comment.objects.order_by('post_id', 'created_at').distinct('post_id').update(deleted=True)

The developer may assume that this will delete only one comment per post_id, however, the distinct() is ignored (as UPDATE has no distinct) which results in the entire table being updated:

UPDATE "post_comment" SET "deleted" = true'

Since delete() already guards against this case, I believe update() should behave consistently to protect the developer from mistakes, even though applying a distinct() before an update() is generally unusual.

Change History (8)

comment:2 by Simon Charette, 3 weeks ago

Triage Stage: Unreviewed → Accepted

comment:3 by Matt Shirley, 3 weeks ago

Owner: set to Matt Shirley
Status: new → assigned

comment:4 by Jacob Walls, 3 weeks ago

Patch needs improvement: set

comment:5 by Matt Shirley, 3 weeks ago

Patch needs improvement: unset

comment:6 by Jacob Walls, 3 weeks ago

Triage Stage: Accepted → Ready for checkin

comment:7 by Jacob Walls, 3 weeks ago

Type: Bug → Cleanup/optimization
Version: 5.2 → dev

comment:8 by Jacob Walls <jacobtylerwalls@…>, 3 weeks ago

Resolution: → fixed
Status: assigned → closed

In 4744e99:

Fixed #36683 -- Added error message on QuerySet.update() following distinct(*fields).

Note: See TracTickets for help on using tickets.
Back to Top