Skip to content

DjangoFilterConnectionField ignoring DjangoObjectType's get_queryset #815

Closed
@bellini666

Description

@bellini666

The PR #796 broke DjangoFilterConnectionField making it always get the raw queryset from the model to apply the filters in it.

I noted this when trying to update my extension (https://github.com/0soft/graphene-django-plus/tree/master/graphene_django_plus) to work with 2.7.0 and seeing some tests failing. There I override DjangoObjectType's get_queryset method to add some permissioning checks and my tests broke when a query that should only return some objects that the test user had access returned everything.

IMO this is a critical bug as people doing things like this (e.g. filtering objects for the current user) could potentially leak unwanted data.

I'm sending a PR at this moment and hope you can release a quick fix ASAP.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions