Skip to content

[pull] main from django:main - #547

Merged
pull[bot] merged 2 commits into
threatcode:mainfrom
django:main
Aug 31, 2026
Merged

[pull] main from django:main#547
pull[bot] merged 2 commits into
threatcode:mainfrom
django:main

Conversation

@pull

@pull pull Bot commented Aug 31, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

adamchainz and others added 2 commits August 31, 2026 11:57
…hing.

Search terms for non-text `__exact` `search_fields` entries were validated
with the model field's `formfield().to_python()`, which failed to reject
invalid terms for two kinds of fields:

- Fields with choices use `TypedChoiceField`, whose `to_python()` returns
  the raw string unvalidated, so any non-matching search term (e.g.
  `"john"` against an `IntegerField` with `choices`) reached the ORM and
  crashed the changelist with a `ValueError` (HTTP 500).

- `BooleanField` uses `forms.BooleanField`, whose `to_python()` maps almost
  any string to `True`, so an arbitrary search term OR-matched every row
  with a `True` value instead of matching nothing.

Boolean search terms are now parsed such that arbitrary strings do not
match anything, and Typed(Multiple)ChoiceField search terms now coerce
to the correct types.

Regression in 4cecf30.

Thanks Adam Johnson for the report and Sarah Boyce for the review.

Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
@pull pull Bot locked and limited conversation to collaborators Aug 31, 2026
@pull pull Bot added the ⤵️ pull label Aug 31, 2026
@pull
pull Bot merged commit 189136c into threatcode:main Aug 31, 2026
13 of 14 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants