[IMP] SQL injection Refactored

bzr revid: ach@tinyerp.com-20100618101641-84cdea9n1pzx36v2

1 files changed, 3 insertions, 3 deletions

diff --git a/bin/workflow/instance.py b/bin/workflow/instance.py
index e1407fd1455..e530d56dcd2 100644
--- a/bin/workflow/instance.py
+++ b/bin/workflow/instance.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 ##############################################################################
-#    
+#
 #    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
@@ -15,7 +15,7 @@
 #    GNU Affero General Public License for more details.
 #
 #    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
 
@@ -71,7 +71,7 @@ def _update_end(cr, inst_id, ident):
         act_names = cr.fetchall()
         cr.execute("update wkf_instance set state='complete' where id=%s", (inst_id,))
         cr.execute("update wkf_workitem set state='complete' where subflow_id=%s", (inst_id,))
-        cr.execute("select i.id,w.osv,i.res_id from wkf_instance i left join wkf w on (i.wkf_id=w.id) where i.id in (select inst_id from wkf_workitem where subflow_id=%s)", (inst_id,))
+        cr.execute("select i.id,w.osv,i.res_id from wkf_instance i left join wkf w on (i.wkf_id=w.id) where i.id IN (select inst_id from wkf_workitem where subflow_id=%s)", (inst_id,))
         for i in cr.fetchall():
             for act_name in act_names:
                 validate(cr, i[0], (ident[0],i[1],i[2]), 'subflow.'+act_name[0])