fastadmin 0.5.0__tar.gz → 0.7.0__tar.gz

{fastadmin-0.5.0 → fastadmin-0.7.0}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: fastadmin
-Version: 0.5.0
+Version: 0.7.0
 Summary: FastAdmin is an easy-to-use Admin Dashboard App for FastAPI/Flask/Django inspired by Django Admin.
-Keywords: admin,dashboard,fastapi,flask,django,tortoise-orm,sqlalchemy,pony,admin-dashboard,django-admin
+Keywords: admin,dashboard,fastapi,flask,django,tortoise-orm,sqlalchemy,pony,yara-orm,admin-dashboard,django-admin
 Author: Seva D
 Author-email: Seva D <vsdudakov@gmail.com>
 License-Expression: MIT
@@ -31,6 +31,7 @@ Requires-Dist: pony>=0.7,<1 ; extra == 'pony'
 Requires-Dist: sqlalchemy[asyncio]>=2,<3 ; extra == 'sqlalchemy'
 Requires-Dist: greenlet>=3 ; extra == 'sqlalchemy'
 Requires-Dist: tortoise-orm>=1,<2 ; extra == 'tortoise-orm'
+Requires-Dist: yara-orm>=1,<2 ; extra == 'yara-orm'
 Requires-Python: >=3.12
 Project-URL: Homepage, https://vsdudakov.github.io/fastadmin/
 Project-URL: Repository, https://github.com/vsdudakov/fastadmin
@@ -42,6 +43,7 @@ Provides-Extra: flask
 Provides-Extra: pony
 Provides-Extra: sqlalchemy
 Provides-Extra: tortoise-orm
+Provides-Extra: yara-orm
 Description-Content-Type: text/markdown
 
 <h1 align="center">FastAdmin — Admin Dashboard for FastAPI, Flask and Django</h1>
@@ -57,7 +59,8 @@ Description-Content-Type: text/markdown
 **FastAdmin** is an easy-to-use **admin dashboard (admin panel) for FastAPI, Flask and
 Django**, inspired by Django Admin. It gives your Python web application a
 production-ready **CRUD admin interface** in minutes — on top of **Tortoise ORM,
-Django ORM, SQLAlchemy or Pony ORM** — with authentication, filters, search,
+Django ORM, SQLAlchemy, Pony ORM or [Yara ORM](https://github.com/vsdudakov/yara-orm)** —
+with authentication, filters, search,
 inline editing, file uploads, CSV/JSON export and dashboard charts out of the box.
 
 FastAdmin is built with relationships in mind and admiration for Django Admin.
@@ -77,7 +80,8 @@ already know FastAdmin.
 - **Any web framework** — mount as a FastAPI sub-app, a Flask blueprint or
   Django urlpatterns.
 - **Any ORM** — first-class admin classes for Tortoise ORM, Django ORM,
-  SQLAlchemy (async) and Pony ORM.
+  SQLAlchemy (async), Pony ORM and [Yara ORM](https://github.com/vsdudakov/yara-orm)
+  (a fast, Rust-engine async ORM).
 - **Authentication & permissions** — pluggable sign-in against your own user
   model, per-action permission hooks, request/user context in every admin method.
 - **Rich form widgets** — 20+ antd-based widgets (rich text, JSON, async
@@ -102,6 +106,7 @@ pip install fastadmin[fastapi,django]        # FastAPI with Django ORM
 pip install fastadmin[fastapi,tortoise-orm]  # FastAPI with Tortoise ORM
 pip install fastadmin[fastapi,pony]          # FastAPI with Pony ORM
 pip install fastadmin[fastapi,sqlalchemy]    # FastAPI with SQLAlchemy (includes greenlet)
+pip install fastadmin[fastapi,yara-orm]      # FastAPI with Yara ORM
 pip install fastadmin[django]                # Django with Django ORM
 pip install fastadmin[django,pony]           # Django with Pony ORM
 pip install fastadmin[flask,sqlalchemy]      # Flask with SQLAlchemy (includes greenlet)
@@ -193,11 +198,15 @@ Runnable example apps for every framework/ORM combination are in
 ## Why FastAdmin?
 
 If you are looking for a **Django-Admin-like admin panel for FastAPI**, an
-**admin interface for SQLAlchemy or Tortoise ORM**, or a lightweight
+**admin interface for SQLAlchemy, Tortoise ORM or
+[Yara ORM](https://github.com/vsdudakov/yara-orm)**, or a lightweight
 **alternative to building a custom back office**, FastAdmin gives you a
 batteries-included, themeable admin UI without code generation, without tying
 your app to a specific framework, and without writing a single React component.
 
+Pair it with [Yara ORM](https://github.com/vsdudakov/yara-orm) — our fast, async
+Python ORM with a Rust engine — for a high-performance FastAPI + admin stack.
+
 ## Contributing
 
 Contributions are welcome — see the

{fastadmin-0.5.0 → fastadmin-0.7.0}/README.md

@@ -11,7 +11,8 @@
 **FastAdmin** is an easy-to-use **admin dashboard (admin panel) for FastAPI, Flask and
 Django**, inspired by Django Admin. It gives your Python web application a
 production-ready **CRUD admin interface** in minutes — on top of **Tortoise ORM,
-Django ORM, SQLAlchemy or Pony ORM** — with authentication, filters, search,
+Django ORM, SQLAlchemy, Pony ORM or [Yara ORM](https://github.com/vsdudakov/yara-orm)** —
+with authentication, filters, search,
 inline editing, file uploads, CSV/JSON export and dashboard charts out of the box.
 
 FastAdmin is built with relationships in mind and admiration for Django Admin.
@@ -31,7 +32,8 @@ already know FastAdmin.
 - **Any web framework** — mount as a FastAPI sub-app, a Flask blueprint or
   Django urlpatterns.
 - **Any ORM** — first-class admin classes for Tortoise ORM, Django ORM,
-  SQLAlchemy (async) and Pony ORM.
+  SQLAlchemy (async), Pony ORM and [Yara ORM](https://github.com/vsdudakov/yara-orm)
+  (a fast, Rust-engine async ORM).
 - **Authentication & permissions** — pluggable sign-in against your own user
   model, per-action permission hooks, request/user context in every admin method.
 - **Rich form widgets** — 20+ antd-based widgets (rich text, JSON, async
@@ -56,6 +58,7 @@ pip install fastadmin[fastapi,django]        # FastAPI with Django ORM
 pip install fastadmin[fastapi,tortoise-orm]  # FastAPI with Tortoise ORM
 pip install fastadmin[fastapi,pony]          # FastAPI with Pony ORM
 pip install fastadmin[fastapi,sqlalchemy]    # FastAPI with SQLAlchemy (includes greenlet)
+pip install fastadmin[fastapi,yara-orm]      # FastAPI with Yara ORM
 pip install fastadmin[django]                # Django with Django ORM
 pip install fastadmin[django,pony]           # Django with Pony ORM
 pip install fastadmin[flask,sqlalchemy]      # Flask with SQLAlchemy (includes greenlet)
@@ -147,11 +150,15 @@ Runnable example apps for every framework/ORM combination are in
 ## Why FastAdmin?
 
 If you are looking for a **Django-Admin-like admin panel for FastAPI**, an
-**admin interface for SQLAlchemy or Tortoise ORM**, or a lightweight
+**admin interface for SQLAlchemy, Tortoise ORM or
+[Yara ORM](https://github.com/vsdudakov/yara-orm)**, or a lightweight
 **alternative to building a custom back office**, FastAdmin gives you a
 batteries-included, themeable admin UI without code generation, without tying
 your app to a specific framework, and without writing a single React component.
 
+Pair it with [Yara ORM](https://github.com/vsdudakov/yara-orm) — our fast, async
+Python ORM with a Rust engine — for a high-performance FastAPI + admin stack.
+
 ## Contributing
 
 Contributions are welcome — see the

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/__init__.py

@@ -32,6 +32,11 @@ try:
 except ModuleNotFoundError:  # pragma: no cover
     logging.info("TortoiseORM is not installed")  # pragma: no cover
 
+try:
+    from fastadmin.models.orms.yaraorm import YaraOrmInlineModelAdmin, YaraOrmModelAdmin  # noqa: F401
+except ModuleNotFoundError:  # pragma: no cover
+    logging.info("Yara ORM is not installed")  # pragma: no cover
+
 # api
 from fastadmin.api.exceptions import AdminApiException  # noqa: F401
 

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/api/frameworks/django/app/api.py

@@ -78,7 +78,13 @@ async def sign_in(request: HttpRequest) -> JsonResponse:
         )
 
         response = JsonResponse({})
-        response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
+        response.set_cookie(
+            settings.ADMIN_SESSION_ID_KEY,
+            value=session_id,
+            httponly=True,
+            secure=settings.ADMIN_SESSION_COOKIE_SECURE,
+            samesite=settings.ADMIN_SESSION_COOKIE_SAMESITE.capitalize(),
+        )
         return response
 
     except AdminApiException as e:

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/api/frameworks/fastapi/api.py

@@ -49,7 +49,13 @@ async def sign_in(
             request=request,
         )
 
-        response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
+        response.set_cookie(
+            settings.ADMIN_SESSION_ID_KEY,
+            value=session_id,
+            httponly=True,
+            secure=settings.ADMIN_SESSION_COOKIE_SECURE,
+            samesite=settings.ADMIN_SESSION_COOKIE_SAMESITE,  # ty: ignore[invalid-argument-type]
+        )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
 

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/api/frameworks/fastapi/app.py

@@ -25,7 +25,9 @@ app.include_router(views_router)
 
 @app.exception_handler(Exception)
 async def exception_handler(_: Request, exc: Exception):
+    # Log the real error server-side but never leak internals to the client.
+    logger.error("Unhandled admin error: %s", exc)
     return JSONResponse(
         status_code=500,
-        content={"exception": str(exc)},
+        content={"exception": "Internal server error."},
     )

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/api/frameworks/flask/api.py

@@ -42,7 +42,13 @@ async def sign_in() -> Response:
             request=request,
         )
         response = make_response({})
-        response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
+        response.set_cookie(
+            settings.ADMIN_SESSION_ID_KEY,
+            value=session_id,
+            httponly=True,
+            secure=settings.ADMIN_SESSION_COOKIE_SECURE,
+            samesite=settings.ADMIN_SESSION_COOKIE_SAMESITE.capitalize(),
+        )
         return response
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/api/helpers.py

@@ -84,15 +84,8 @@ def is_valid_id(id: UUID | int | str) -> bool:
     :return: True if id is a valid id, False otherwise.
     """
     if isinstance(id, str):
-        if not id:
-            return False
-        if is_valid_uuid(id):
-            return True
-        try:
-            int(id)
-            return True
-        except ValueError:
-            return True  # string PK (e.g. non-numeric)
+        # Any non-empty string is a valid PK (UUID, numeric, or opaque string PK).
+        return bool(id)
     if is_valid_uuid(str(id)):
         return True
     try:

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/api/service.py

@@ -75,13 +75,47 @@ async def get_user_id_from_session_id(session_id: str | None) -> UUID | int | No
     if not user_id:
         return None
 
-    if not user_id or not await admin_model.get_obj(user_id):
+    if not await admin_model.get_obj(user_id):
         return None
 
     return user_id
 
 
+# Filter lookups a request may use. Anything else (e.g. regex, startswith, or a
+# relation-spanning "groups__name__icontains") is rejected so it cannot become a
+# side-channel oracle over columns the admin never displays.
+ALLOWED_FILTER_CONDITIONS = frozenset({"exact", "in", "lt", "lte", "gt", "gte", "contains", "icontains"})
+
+
 class ApiService:
+    @staticmethod
+    def _clamp_query_limits(query_params: ListQuerySchema) -> None:
+        """Bound offset/limit so a crafted request cannot dump/DoS a table."""
+        if query_params.offset is None or query_params.offset < 0:
+            query_params.offset = 0
+        max_limit = settings.ADMIN_QUERY_MAX_LIMIT
+        if query_params.limit is None or query_params.limit < 0 or query_params.limit > max_limit:
+            query_params.limit = max_limit
+
+    @staticmethod
+    def _validate_filters(admin_model: Any, filters: dict, exclude_filter_fields: tuple, fields: set) -> None:
+        """Validate filter keys against an allowlist and permitted lookups.
+
+        The filterable field set is ``list_filter`` when the admin defines it,
+        otherwise the serialized field set; the lookup suffix must be one of
+        ALLOWED_FILTER_CONDITIONS.
+        """
+        list_filter = getattr(admin_model, "list_filter", ())
+        allowlist = set(list_filter) if list_filter else fields
+        for k in filters:
+            if k in exclude_filter_fields:
+                continue
+            field, _, condition = k.partition("__")
+            if condition and condition not in ALLOWED_FILTER_CONDITIONS:
+                raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+            if field not in allowlist:
+                raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+
     @staticmethod
     def _bind_admin_context(
         admin_model: ModelAdmin | InlineModelAdmin | Any, request: Any | None, user: Any | None
@@ -102,6 +136,19 @@ class ApiService:
         )
         return current_user_id, current_user
 
+    @staticmethod
+    async def _require_permission(admin_model: Any, permission: str, user_id: UUID | int | None) -> None:
+        """Enforce a model-admin permission hook server-side.
+
+        The has_*_permission hooks gate the UI, but every mutating endpoint must
+        also enforce them so a crafted request cannot bypass a disabled action.
+        """
+        check = getattr(admin_model, permission, None)
+        if check is None:
+            return
+        if not await check(user_id=user_id):
+            raise AdminApiException(403, detail="You do not have permission to perform this action.")
+
     async def sign_in(
         self,
         session_id: str | None,
@@ -167,6 +214,7 @@ class ApiService:
             offset=offset,
             limit=limit,
         )
+        self._clamp_query_limits(query_params)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
@@ -184,12 +232,7 @@ class ApiService:
         exclude_filter_fields = ("search", "sort_by", "offset", "limit")
         query_filters: dict[tuple[str, str], bool | str | None | list] | None = None
         if query_params.filters:
-            for k in query_params.filters:
-                if k in exclude_filter_fields:
-                    continue
-                field = k.split("__", 1)[0]
-                if field not in fields:
-                    raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+            self._validate_filters(admin_model, query_params.filters, exclude_filter_fields, fields)
             query_filters = {
                 sanitize_filter_key(k, admin_model.get_model_fields_with_widget_types()): sanitize_filter_value(v)
                 for k, v in query_params.filters.items()
@@ -235,7 +278,7 @@ class ApiService:
             obj = await admin_model.get_obj(id)
         except Exception as e:
             logger.error("Error getting %s %s: %s", model, id, e)
-            raise AdminApiException(500, detail=f"Error getting {model} {id}: {e}") from e
+            raise AdminApiException(500, detail=f"Error getting {model}.") from e
         if not obj:
             raise AdminApiException(404, detail=f"{model} not found.")
         return obj
@@ -247,17 +290,20 @@ class ApiService:
         payload: dict,
         request: Any | None = None,
     ) -> dict:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_add_permission", current_user_id)
         try:
             return await admin_model.save_model(None, payload)  # ty: ignore[invalid-return-type]
+        except AdminApiException:
+            raise
         except Exception as e:
             logger.error("Error adding %s: %s", model, e)
-            raise AdminApiException(500, detail=f"Error adding {model}: {e}") from e
+            raise AdminApiException(500, detail=f"Error adding {model}.") from e
 
     async def change_password(
         self,
@@ -266,13 +312,19 @@ class ApiService:
         payload: dict,
         request: Any | None = None,
     ) -> None:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_model(settings.ADMIN_USER_MODEL)
         if not admin_model:
             raise AdminApiException(404, detail=f"{settings.ADMIN_USER_MODEL} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
 
+        # Users may change their own password; changing anyone else's requires the
+        # user-model change permission. Without this a signed-in user could reset a
+        # superuser's password (account takeover).
+        if str(id) != str(current_user_id):
+            await self._require_permission(admin_model, "has_change_permission", current_user_id)
+
         payload = ChangePasswordInputSchema(**payload)
         if payload.password != payload.confirm_password:
             raise AdminApiException(422, detail="Passwords do not match")
@@ -285,7 +337,8 @@ class ApiService:
         try:
             user = await admin_model.get_obj(id)
         except Exception as e:
-            raise AdminApiException(500, detail=f"Error getting {settings.ADMIN_USER_MODEL} {id}: {e}") from e
+            logger.error("Error getting %s %s: %s", settings.ADMIN_USER_MODEL, id, e)
+            raise AdminApiException(500, detail=f"Error getting {settings.ADMIN_USER_MODEL}.") from e
         if not user:
             raise AdminApiException(404, detail=f"{settings.ADMIN_USER_MODEL} not found.")
 
@@ -306,18 +359,21 @@ class ApiService:
         payload: dict,
         request: Any | None = None,
     ) -> dict:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_change_permission", current_user_id)
 
         try:
             obj = await admin_model.save_model(id, payload)
+        except AdminApiException:
+            raise
         except Exception as e:
             logger.error("Error changing %s %s: %s", model, id, e)
-            raise AdminApiException(500, detail=f"Error changing {model} {id}: {e}") from e
+            raise AdminApiException(500, detail=f"Error changing {model}.") from e
         if not obj:
             raise AdminApiException(404, detail=f"{model} not found.")
         return obj
@@ -358,7 +414,8 @@ class ApiService:
         except AdminApiException:
             raise
         except Exception as e:
-            raise AdminApiException(500, detail=f"Error uploading file for {model}: {e}") from e
+            logger.error("Error uploading file for %s: %s", model, e)
+            raise AdminApiException(500, detail=f"Error uploading file for {model}.") from e
 
     async def export(
         self,
@@ -370,7 +427,7 @@ class ApiService:
         filters: dict | None = None,
         request: Any | None = None,
     ) -> tuple[str, str, StringIO | BytesIO | None]:
-        _current_user_id, current_user = await self._get_authenticated_user(session_id)
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         query_params = ListQuerySchema(
             search=search,
@@ -379,11 +436,13 @@ class ApiService:
             offset=payload.offset,
             limit=payload.limit,
         )
+        self._clamp_query_limits(query_params)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_export_permission", current_user_id)
 
         # validations
         fields = set(admin_model.get_fields_for_serialize())
@@ -396,12 +455,7 @@ class ApiService:
         exclude_filter_fields = ("search", "sort_by", "offset", "limit")
         query_filters: dict[tuple[str, str], bool | str | None | list] | None = None
         if query_params.filters:
-            for k in query_params.filters:
-                if k in exclude_filter_fields:
-                    continue
-                field = k.split("__", 1)[0]
-                if field not in fields:
-                    raise AdminApiException(422, detail=f"Filter by {k} is not allowed")
+            self._validate_filters(admin_model, query_params.filters, exclude_filter_fields, fields)
             query_filters = {
                 sanitize_filter_key(k, admin_model.get_model_fields_with_widget_types()): sanitize_filter_value(v)
                 for k, v in query_params.filters.items()
@@ -450,6 +504,7 @@ class ApiService:
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
         self._bind_admin_context(admin_model, request=request, user=current_user)
+        await self._require_permission(admin_model, "has_delete_permission", current_user_id)
 
         if str(current_user_id) == str(id) and model == settings.ADMIN_USER_MODEL:
             raise AdminApiException(403, detail="You cannot delete yourself.")
@@ -457,7 +512,7 @@ class ApiService:
             await admin_model.delete_model(id)
         except Exception as e:
             logger.error("Error deleting %s %s: %s", model, id, e)
-            raise AdminApiException(500, detail=f"Error deleting {model} {id}: {e}") from e
+            raise AdminApiException(500, detail=f"Error deleting {model}.") from e
         return id
 
     async def action(

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/models/base.py

@@ -16,6 +16,21 @@ from fastadmin.models.schemas import ModelFieldWidgetSchema, WidgetType
 
 Model = Any
 
+# Leading characters a spreadsheet interprets as the start of a formula.
+_CSV_FORMULA_PREFIXES = ("=", "+", "-", "@", "\t", "\r")
+
+
+def _neutralize_csv_value(value: Any) -> Any:
+    """Prevent CSV formula injection in exported data.
+
+    A cell like ``=HYPERLINK(...)`` or ``=cmd|...`` is executed by Excel/Sheets
+    when the export is opened. Prefix any string starting with a formula trigger
+    with a single quote so it is treated as text; non-strings pass through.
+    """
+    if isinstance(value, str) and value and value[0] in _CSV_FORMULA_PREFIXES:
+        return "'" + value
+    return value
+
 
 class BaseModelAdmin:
     """Base class for model admin"""
@@ -358,6 +373,24 @@ class BaseModelAdmin:
             fields_for_serialize |= set(self.list_display)
         return fields_for_serialize
 
+    def get_writable_field_names(self) -> set[str]:
+        """Model field names the admin form is allowed to write.
+
+        Enforced server-side in :meth:`save_model` so a crafted payload cannot
+        set fields hidden by ``fields``/``exclude`` or marked ``readonly_fields``
+        (e.g. ``is_superuser``). ``list_display``-only computed columns are not
+        included since they are not real model fields.
+
+        :return: A set of writable model field names.
+        """
+        writable = {field.name for field in self.get_model_fields_with_widget_types()}
+        if self.fields:
+            writable &= set(self.fields)
+        if self.exclude:
+            writable -= set(self.exclude)
+        writable -= set(self.readonly_fields)
+        return writable
+
     def resolve_sort_by(self, sort_by: str) -> str:
         """Resolve sort_by to the actual ORM ordering expression.
 
@@ -523,18 +556,19 @@ class BaseModelAdmin:
         """
         fields = self.get_model_fields_with_widget_types(with_m2m=False)
         m2m_fields = self.get_model_fields_with_widget_types(with_m2m=True)
+        writable = self.get_writable_field_names()
 
         fields_payload = {
             field.column_name: self.deserialize_value(field, payload[field.name])
             for field in fields
-            if field.name in payload
+            if field.name in payload and field.name in writable
         }
         obj = await self.orm_save_obj(id, fields_payload)
         if not obj:
             return None
 
         for m2m_field in m2m_fields:
-            if m2m_field.name in payload:
+            if m2m_field.name in payload and m2m_field.name in writable:
                 await self.orm_save_m2m_ids(obj, m2m_field.column_name, payload[m2m_field.name])
 
         return await self._serialize_obj_after_save(obj)
@@ -630,7 +664,7 @@ class BaseModelAdmin:
                 writer.writeheader()
                 for obj in objs:
                     obj_dict = await self.serialize_obj(obj, list_view=True)
-                    obj_dict = {k: v for k, v in obj_dict.items() if k in export_fields}
+                    obj_dict = {k: _neutralize_csv_value(v) for k, v in obj_dict.items() if k in export_fields}
                     writer.writerow(obj_dict)
                 output.seek(0)
                 return output
@@ -643,8 +677,13 @@ class BaseModelAdmin:
                         except TypeError:
                             return str(o)
 
+                # Emit the same column set as CSV so the two formats are consistent.
+                rows = []
+                for obj in objs:
+                    obj_dict = await self.serialize_obj(obj, list_view=True)
+                    rows.append({k: v for k, v in obj_dict.items() if k in export_fields})
                 output = StringIO()
-                json.dump([await self.serialize_obj(obj, list_view=True) for obj in objs], output, cls=JSONEncoder)
+                json.dump(rows, output, cls=JSONEncoder)
                 output.seek(0)
                 return output
             case _:
@@ -761,8 +800,10 @@ class ModelAdmin(BaseModelAdmin):
         obj = await super().save_model(id, payload)
         fields = self.get_model_fields_with_widget_types(with_m2m=False)
         password_fields = [field.name for field in fields if field.form_widget_type == WidgetType.PasswordInput]
-        if obj and id is None and password_fields:
-            # save hashed password for create
+        if obj and password_fields:
+            # Hash the submitted password via change_password on both create and
+            # edit. On edit the raw value was written by the base save_model, so
+            # hashing here overwrites it — the column never keeps a plaintext value.
             pk_name = self.get_model_pk_name(self.model_cls)
             pk = obj[pk_name]
             password_values = [payload[field] for field in password_fields if field in payload]

{fastadmin-0.5.0 → fastadmin-0.7.0}/fastadmin/models/orms/ponyorm.py

@@ -12,6 +12,32 @@ from fastadmin.models.schemas import ModelFieldWidgetSchema, WidgetType
 from fastadmin.settings import settings
 
 
+def _pony_filter_expr(condition: str, field: str) -> str:
+    """Build a Pony filter string that references the value via the local `fval`.
+
+    The caller binds ``fval`` (and ``fval.lower()`` for icontains) as a local so
+    Pony resolves it as a query parameter. ``field`` is a validated/allowlisted
+    path, so interpolating it is safe; the user value is never interpolated.
+    """
+    match condition:
+        case "in":
+            return f"m.{field} in fval"
+        case "lte":
+            return f"m.{field} <= fval"
+        case "gte":
+            return f"m.{field} >= fval"
+        case "lt":
+            return f"m.{field} < fval"
+        case "gt":
+            return f"m.{field} > fval"
+        case "contains":
+            return f"fval in m.{field}"
+        case "icontains":
+            return f"fval.lower() in m.{field}.lower()"
+        case _:  # exact
+            return f"m.{field} == fval"
+
+
 class PonyORMMixin:
     @staticmethod
     def get_model_pk_name(orm_model_cls: Any) -> str:
@@ -235,42 +261,25 @@ class PonyORMMixin:
                 model_pk_name = self.get_model_pk_name(self.model_cls)
                 if field.endswith(f"_{model_pk_name}"):
                     field = field.replace(f"_{model_pk_name}", f".{model_pk_name}")
-                if condition == "in":
-                    value_set = set(value)
-                    qs = qs.filter(
-                        lambda m, f=field, vs=value_set: getattr(m, f) in vs,
-                    )
-                    continue
-                pony_condition = "=="
-                match condition:
-                    case "lte":
-                        pony_condition = ">="
-                    case "gte":
-                        pony_condition = "<="
-                    case "lt":
-                        pony_condition = ">"
-                    case "gt":
-                        pony_condition = "<"
-                    case "exact":
-                        pony_condition = "=="
-                    case "contains":
-                        pony_condition = "in"
-                    case "icontains":
-                        # Pony string filter: value.lower() in m.field.lower() for case-insensitive
-                        filter_expr = f'"{value.lower()}" in m.{field}.lower()'
-                        qs = qs.filter(filter_expr)
-                        continue
-                filter_expr = f""""{value}" {pony_condition}  m.{field}"""
-                qs = qs.filter(filter_expr)
+                # Bind the user-supplied value as a local (`fval`) so Pony
+                # resolves it as a query parameter. Only the field path — built
+                # from the admin's validated/allowlisted field names — is
+                # interpolated; the value is never placed into the filter string
+                # (Pony evaluates filter strings as Python expressions).
+                fval = set(value) if condition == "in" else value  # noqa: F841 (referenced by Pony filter string)
+                expr = _pony_filter_expr(condition, field)
+                qs = qs.filter(expr)
 
         search_fields = list(self.search_fields)
         if search and search_fields:
             ids = []
+            # Bind the user-supplied search term as a local so Pony resolves it
+            # as a parameter. Only the field path (from the admin's trusted
+            # search_fields config) is interpolated — never the search value.
+            search_term = search.lower()  # noqa: F841 (referenced by Pony filter string)
             for search_field in search_fields:
                 pony_search_field = search_field.replace("__", ".")
-                # Pony string filter for case-insensitive search
-                filter_expr = f'"{search.lower()}" in m.{pony_search_field}.lower()'
-                qs_ids = qs.filter(filter_expr)
+                qs_ids = qs.filter(f"search_term in m.{pony_search_field}.lower()")
                 objs = list(qs_ids)
                 ids += [o.id for o in objs]
             qs = qs.filter(lambda m: m.id in set(ids))