diff options
| author | P. Christeas <p_christ@hol.gr> | 2010-10-12 13:37:23 +0300 |
|---|---|---|
| committer | P. Christeas <p_christ@hol.gr> | 2010-10-12 13:37:23 +0300 |
| commit | eeffc06f2afddcd6cdb1f19ca6b31b3acfa3396b (patch) | |
| tree | 134ae730a2348c81648e97a37b95785c7c9674df | |
| parent | 50bad302ad09a711804661f19638e7c5fd0613af (diff) | |
base_calendar, caldav: revise SQL calls.
bzr revid: p_christ@hol.gr-20101012103723-alnh7rkf1g8tthlo
| -rw-r--r-- | addons/base_calendar/base_calendar.py | 4 | ||||
| -rw-r--r-- | addons/caldav/calendar.py | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/addons/base_calendar/base_calendar.py b/addons/base_calendar/base_calendar.py index 1ff7777cf36..2a0b0cc60ad 100644 --- a/addons/base_calendar/base_calendar.py +++ b/addons/base_calendar/base_calendar.py @@ -1065,7 +1065,7 @@ class calendar_event(osv.osv): 'rule_type': rrule_type, 'id': id, }) - cr.execute(qry % val) + cr.execute(qry, val) # Hopefully psycopg2 works with dicts. But, FIXME return True def _get_rulestring(self, cr, uid, ids, name, arg, context=None): @@ -1682,7 +1682,7 @@ class calendar_todo(osv.osv): @param args: list of tuples of form [(‘name_of_the_field’, ‘operator’, value), ...]. @param context: A standard dictionary for contextual values """ - + assert name == 'date' return self.write(cr, uid, id, { 'date_start': value }, context=context) diff --git a/addons/caldav/calendar.py b/addons/caldav/calendar.py index 068af56459f..883688c38f6 100644 --- a/addons/caldav/calendar.py +++ b/addons/caldav/calendar.py @@ -63,8 +63,8 @@ def uid2openobjectid(cr, uidval, oomodel, rdate): return (False, None) qry = 'SELECT DISTINCT(id) FROM %s' % model_obj._table if rdate: - qry += " where recurrent_id='%s'" % (rdate) #TOFIX: sql injection - cr.execute(qry) + qry += " WHERE recurrent_id=%s" + cr.execute(qry, (rdate,)) r_id = cr.fetchone() if r_id: return (id, r_id[0]) |