m2m relationships with a through field don't respect types.

[Justin Lilly]

I ran into an issue today in which an empty list was returned from a Queryset when it should have been a blatant failure.

Given the models in ​https://github.com/django/django/blob/master/tests/modeltests/m2m_through/models.py

The following returns an empty queryset:

  Group.objects.filter(members__in=[Friendship(pk=9)])

[Carl Meyer]

I don't believe this bug is specific to m2ms or through models at all. In general, currently you can pass any iterable of instances of any model to any __in query and the ORM will happily use the PKs of the models you give it, without checking whether they are an instance of the right model class (or a subclass, or raw PK values which is also supported).

[Carl Meyer]

(Also not specific to __in queries, same is true of a simple __exact match on an FK field).

[Alex Gaynor]

Everything you just said is correct, it's not just your belief :)

[Preston Holmes]

So looking at this mostly for my own edification.

A higher level place this could be checked would be db.models.where.Constraint.process

otherwise: db.models.fields.related.RelatedField.get_db_prep_lookup and db.models.fields.related.RelatedField._pk_trace

seem like the best places to tackle this.

However unless a patch is pretty quick, it seems worth improving the docs, at least in the interim, to clarify that lookup values for model instances will always be converted to a simple pk value for database lookups.

[Marten Kenbeek]

Fixed as part of 34ba86706f0db33d9a0ab44e4abb78703e7262a9:

Fixed #14334 -- Query relation lookups now check object types.