diff options
| author | Christophe Simonis <chs@tinyerp.com> | 2010-02-03 19:32:55 +0100 |
|---|---|---|
| committer | Christophe Simonis <chs@tinyerp.com> | 2010-02-03 19:32:55 +0100 |
| commit | 3ff98ce1d9f59ea7045865b619ef78cb19c7b933 (patch) | |
| tree | b340b43dc576525118c9f71ffba9ff7919f0bab1 /addons/account/sequence.py | |
| parent | 3d76b8d4114b343ac7c4e4d8720504bba21741b9 (diff) | |
[FIX] avoid sql injection in sequences
lp bug: https://launchpad.net/bugs/512682 fixed
bzr revid: chs@tinyerp.com-20100203183255-21lh44tfloc01wqw
Diffstat (limited to 'addons/account/sequence.py')
| -rw-r--r-- | addons/account/sequence.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/addons/account/sequence.py b/addons/account/sequence.py index 02af766a7d7..8b38fe19690 100644 --- a/addons/account/sequence.py +++ b/addons/account/sequence.py @@ -44,6 +44,8 @@ class ir_sequence(osv.osv): 'fiscal_ids' : fields.one2many('account.sequence.fiscalyear', 'sequence_main_id', 'Sequences') } def get_id(self, cr, uid, sequence_id, test='id=%s', context={}): + if test not in ('id=%s', 'code=%s'): + raise ValueError('invalid test') cr.execute('select id from ir_sequence where '+test+' and active=%s', (sequence_id, True,)) res = cr.dictfetchone() if res: |