KristianOellegaard/django-hvad — pull request #160 by spectras (2014-03-07 13:24:22+00:00)
Title: Fix: if not queryset…

This is a one-liner, although it has performance and security implications.

Evaluating a queryset in a boolean context invokes its __nonzero__ method, which fetches all records and evaluates to False if no results are found. The actual intent there was to test whether the queryset argument was set, so let's just do that.

Also, if the queryset is empty, it will try to use get\_queryset to make a new one out of the model, bypassing any filter that was applied to passed queryset, thus the security implications.

(I hit this mistake in my own code, then grep -r caught it in hvad too, so I figured I could share)