diff --git a/flask_admin/contrib/sqla/view.py b/flask_admin/contrib/sqla/view.py index e3bbbba11..320af0c1c 100644 --- a/flask_admin/contrib/sqla/view.py +++ b/flask_admin/contrib/sqla/view.py @@ -1329,7 +1329,13 @@ def get_one(self, id): Model id """ session = _get_deprecated_session(self.session) - return session.get(self.model, tools.iterdecode(id)) + _id = tools.iterdecode(id) + if isinstance(self._primary_key, tuple): + _id = tools.iterdecode(id) + else: + _id = (tools.escape(id),) + + return session.get(self.model, _id) # Error handler def handle_view_exception(self, exc: Exception) -> bool: diff --git a/flask_admin/tests/sqla/test_basic.py b/flask_admin/tests/sqla/test_basic.py index 4b4954bf3..90ce3a00f 100644 --- a/flask_admin/tests/sqla/test_basic.py +++ b/flask_admin/tests/sqla/test_basic.py @@ -892,6 +892,16 @@ def test_details_view(app, db, admin, session_or_db): assert "test2_val_1" in data assert "test1_val_1" in data + # test single-PK with multiple IDs in query string + rv = client.get( + "/admin/model2/details/?url=%2Fadmin%2Fmodel2%2F&id=1,2", + follow_redirects=True, + ) + data = rv.data.decode("utf-8") + assert "String Field" in data + assert "test2_val_1" in data + assert "test1_val_1" in data + # test column_details_list rv = client.get("/admin/sf_view/details/?url=%2Fadmin%2Fsf_view%2F&id=1") data = rv.data.decode("utf-8")