Closed
Description
The PR #796 broke DjangoFilterConnectionField making it always get the raw queryset from the model to apply the filters in it.
I noted this when trying to update my extension (https://github.com/0soft/graphene-django-plus/tree/master/graphene_django_plus) to work with 2.7.0 and seeing some tests failing. There I override DjangoObjectType's get_queryset method to add some permissioning checks and my tests broke when a query that should only return some objects that the test user had access returned everything.
IMO this is a critical bug as people doing things like this (e.g. filtering objects for the current user) could potentially leak unwanted data.
I'm sending a PR at this moment and hope you can release a quick fix ASAP.
Metadata
Metadata
Assignees
Labels
No labels