#14357: Prevent innapropriate order-based grouping on values+annotate queries
-------------------------------------+-------------------------------------
Reporter: Martin Chase | Owner: (none)
Type: Bug | Status: new
Component: Database layer | Version:
(models, ORM) |
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Simon Charette):
I think we should go as far as requiring all ordering clauses to be
explicitly specified through `values()` when used to group by.
For example, in the following case
`Foo.objects.order_by('name').values('type').annotate(Count('name'))`
A deprecation warning would be raised to notify the user that `'name'`
won't automatically be added to `values()` in future Django version where
the previous queryset would be equivalent to the following:
`Foo.objects.values('type').annotate(Count('name'))`
and the current behaviour could be preserved by adding `'name'` to
`values()`:
`Foo.objects.order_by('name').values('type',
'name').annotate(Count('name'))`
I haven't tested it myself to see if it's already the case but we should
also disallow ordering by a non-grouped column or aggregate alias.
`Foo.objects.values('type').annotate(Count('name')).order_by('name')`
should raise a value error on the `order_by('name')` call.
--
Ticket URL: <https://code.djangoproject.com/ticket/14357#comment:11>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/070.b1396c53abdbbd6172922849885e426f%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
