diff options
| author | Olivier Dony <odo@openerp.com> | 2011-01-15 02:31:09 +0100 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2011-01-15 02:31:09 +0100 |
| commit | 697eea26e4325eac5f4831334df1b79bf7df2eb2 (patch) | |
| tree | c0c17d996e8d8d7a28042a8198fd933fbeca43a1 | |
| parent | 570d35e8244f588b4ead88ed573e8cf73b073c8b (diff) | |
[FIX] orm.read_group: prepend fields with table names to avoid collisions in SQL queries
lp bug: https://launchpad.net/bugs/703105 fixed
bzr revid: odo@openerp.com-20110115013109-q1ekx17docisqhd0
| -rw-r--r-- | bin/osv/orm.py | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/bin/osv/orm.py b/bin/osv/orm.py index a6a45dd1a24..3d7cce06af0 100644 --- a/bin/osv/orm.py +++ b/bin/osv/orm.py @@ -2134,10 +2134,11 @@ class orm(orm_template): # Take care of adding join(s) if groupby is an '_inherits'ed field groupby_list = groupby + qualified_groupby_field = groupby if groupby: if isinstance(groupby, list): groupby = groupby[0] - self._inherits_join_calc(groupby, query) + qualified_groupby_field = self._inherits_join_calc(groupby, query) if groupby: assert not groupby or groupby in fields, "Fields in 'groupby' must appear in the list of fields to read (perhaps it's missing in the list view?)" @@ -2151,10 +2152,10 @@ class orm(orm_template): if groupby: if fget.get(groupby): if fget[groupby]['type'] in ('date', 'datetime'): - flist = "to_char(%s,'yyyy-mm') as %s " % (groupby, groupby) - groupby = "to_char(%s,'yyyy-mm')" % (groupby) + flist = "to_char(%s,'yyyy-mm') as %s " % (qualified_groupby_field, groupby) + groupby = "to_char(%s,'yyyy-mm')" % (qualified_groupby_field) else: - flist = groupby + flist = qualified_groupby_field else: # Don't allow arbitrary values, as this would be a SQL injection vector! raise except_orm(_('Invalid group_by'), @@ -2168,10 +2169,11 @@ class orm(orm_template): if f not in ['id', 'sequence']: group_operator = fget[f].get('group_operator', 'sum') if flist: - flist += ',' - flist += group_operator+'('+f+') as '+f + flist += ', ' + qualified_field = '"%s"."%s"' % (self._table, f) + flist += "%s(%s) AS %s" % (group_operator, qualified_field, f) - gb = groupby and (' GROUP BY '+groupby) or '' + gb = groupby and (' GROUP BY ' + qualified_groupby_field) or '' from_clause, where_clause, where_clause_params = query.get_sql() where_clause = where_clause and ' WHERE ' + where_clause |