diff options
| author | vra <vra@tinyerp.com> | 2010-06-18 13:06:46 +0530 |
|---|---|---|
| committer | vra <vra@tinyerp.com> | 2010-06-18 13:06:46 +0530 |
| commit | e13bb3c98c7de433c7a56cdc055780dc0239b725 (patch) | |
| tree | a47419e151d279ec79be2135a178fba9fac0c7e6 /addons/project_long_term | |
| parent | bffad7400e8b828edeca70eb315e43950fea1130 (diff) | |
| parent | fd1578daecbcddfc4d8d9070d721ca1d8500c84e (diff) | |
[MERGE] SQL-Injection Fixes
bzr revid: vra@tinyerp.com-20100618073646-edml7q843xzkq84x
Diffstat (limited to 'addons/project_long_term')
| -rw-r--r-- | addons/project_long_term/project_long_term.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/addons/project_long_term/project_long_term.py b/addons/project_long_term/project_long_term.py index 57fbd1abb5f..f1c40a4c8ba 100644 --- a/addons/project_long_term/project_long_term.py +++ b/addons/project_long_term/project_long_term.py @@ -45,7 +45,7 @@ class project_phase(osv.osv): next_ids = [rec.id for rec in next_ids] # iter prev_ids while prev_ids: - cr.execute('select distinct prv_phase_id from project_phase_rel where next_phase_id in ('+','.join(map(str, prev_ids))+')') + cr.execute('select distinct prv_phase_id from project_phase_rel where next_phase_id IN %s',(tuple(prev_ids),)) prv_phase_ids = filter(None, map(lambda x: x[0], cr.fetchall())) if data_phase.id in prv_phase_ids: return False @@ -55,7 +55,7 @@ class project_phase(osv.osv): prev_ids = prv_phase_ids # iter next_ids while next_ids: - cr.execute('select distinct next_phase_id from project_phase_rel where prv_phase_id in ('+','.join(map(str, next_ids))+')') + cr.execute('select distinct next_phase_id from project_phase_rel where prv_phase_id IN %s',(tuple(next_ids),)) next_phase_ids = filter(None, map(lambda x: x[0], cr.fetchall())) if data_phase.id in next_phase_ids: return False |