diff options
| author | vra <vra@tinyerp.com> | 2010-06-16 17:21:39 +0530 |
|---|---|---|
| committer | vra <vra@tinyerp.com> | 2010-06-16 17:21:39 +0530 |
| commit | bf8d2a73c06154918874220b8bfb1251dc614088 (patch) | |
| tree | 59f7f764eddbf736677e7005073d45fb283d3cba /addons/project_long_term/project_long_term.py | |
| parent | 3fcdccbeca610a645085e652de4fa2824be99568 (diff) | |
[IMP][REF] Sql-injection changes, remove print statement, some space improvement.
bzr revid: vra@tinyerp.com-20100616115139-cql5oiqf622spa6p
Diffstat (limited to 'addons/project_long_term/project_long_term.py')
| -rw-r--r-- | addons/project_long_term/project_long_term.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/project_long_term/project_long_term.py b/addons/project_long_term/project_long_term.py index 57fbd1abb5f..f1c40a4c8ba 100644 --- a/addons/project_long_term/project_long_term.py +++ b/addons/project_long_term/project_long_term.py @@ -45,7 +45,7 @@ class project_phase(osv.osv): next_ids = [rec.id for rec in next_ids] # iter prev_ids while prev_ids: - cr.execute('select distinct prv_phase_id from project_phase_rel where next_phase_id in ('+','.join(map(str, prev_ids))+')') + cr.execute('select distinct prv_phase_id from project_phase_rel where next_phase_id IN %s',(tuple(prev_ids),)) prv_phase_ids = filter(None, map(lambda x: x[0], cr.fetchall())) if data_phase.id in prv_phase_ids: return False @@ -55,7 +55,7 @@ class project_phase(osv.osv): prev_ids = prv_phase_ids # iter next_ids while next_ids: - cr.execute('select distinct next_phase_id from project_phase_rel where prv_phase_id in ('+','.join(map(str, next_ids))+')') + cr.execute('select distinct next_phase_id from project_phase_rel where prv_phase_id IN %s',(tuple(next_ids),)) next_phase_ids = filter(None, map(lambda x: x[0], cr.fetchall())) if data_phase.id in next_phase_ids: return False |