#9848 closed (fixed)
QuerySet.update() can cause data corruption if the QuerySet filters only on fields in other tables
| Reported by: | Jamie Gennis | Owned by: | Jamie Gennis |
|---|---|---|---|
| Component: | Database layer (models, ORM) | Version: | 1.0 |
| Severity: | Keywords: | ||
| Cc: | Triage Stage: | Accepted | |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
Changeset 7496 introduced an optimization for filtered updates that eliminates the table being updated from the sub-select used to do the filtering. This optimization is used when the filter does not reference any fields in the update-table (i.e. the table being updated). To do this the sub-select must select IDs from a column in one of the related tables rather than the update-table. However, the where clause of the update still filters based on the primary key of the update-table being in the result set of the sub-select. This means that in some cases it will update the rows for which the update-table's primary key matches the primary key of one of the related tables, potentially causing data corruption.
Attachments (1)
Change History (8)
by , 15 years ago
| Attachment: | filtered_update_fix.diff added |
|---|
comment:1 by , 15 years ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:2 by , 15 years ago
| milestone: | → 1.1 |
|---|---|
| Triage Stage: | Unreviewed → Accepted |
comment:3 by , 15 years ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
comment:4 by , 15 years ago
I wasn't losing my mind after all. This was fixed in r9967 (I thought that was the case, but applied the test here to the wrong revision when verifying that). So, for the record, that's when it was fixed.
comment:5 by , 15 years ago
(In [10607]) [1.0.X] Added a test from Jamie Gennis to ensure #9848 doesn't reappear.
The bug itself was fixed at some point in the past months (there have
been a few improvements to update() recently). Fixed #9848.
(Merge of r10528 from trunk. Per comment in #9848 the fix was in r9967,
which was backported in r9968, thus it seems right to backport the new
test as well.)
Fixed in r10528.