diff options
| author | Anup (OpenERP) <ach@tinyerp.com> | 2010-06-15 18:57:22 +0530 |
|---|---|---|
| committer | Anup (OpenERP) <ach@tinyerp.com> | 2010-06-15 18:57:22 +0530 |
| commit | 6b90ca82c585269c45ac03326fb501b411624f3d (patch) | |
| tree | bd1117615e73f43257fcd3210c7f3c5786cbd352 /bin/addons/base/module/module.py | |
| parent | ce120b0f64ace1a055e5e7c514e754f85a76e612 (diff) | |
[IMP] removed the possible SQL injection server.
bzr revid: ach@tinyerp.com-20100615132722-zbua6ciz3dz43qd8
Diffstat (limited to 'bin/addons/base/module/module.py')
| -rw-r--r-- | bin/addons/base/module/module.py | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/bin/addons/base/module/module.py b/bin/addons/base/module/module.py index e29e95bf68f..9d4ba1df952 100644 --- a/bin/addons/base/module/module.py +++ b/bin/addons/base/module/module.py @@ -44,7 +44,14 @@ class module_category(osv.osv): _description = "Module Category" def _module_nbr(self,cr,uid, ids, prop, unknow_none,context): - cr.execute('select category_id,count(*) from ir_module_module where category_id in ('+','.join(map(str, ids))+') or category_id in (select id from ir_module_category where parent_id in ('+','.join(map(str, ids))+')) group by category_id') + cr.execute('SELECT category_id, COUNT(*) \ + FROM ir_module_module \ + WHERE category_id IN %(ids)s \ + OR category_id IN (SELECT id \ + FROM ir_module_category \ + WHERE parent_id IN %(ids)s) \ + GROUP BY category_id', {'ids': tuple(ids)} + ) result = dict(cr.fetchall()) for id in ids: cr.execute('select id from ir_module_category where parent_id=%s', (id,)) |