From bf8d2a73c06154918874220b8bfb1251dc614088 Mon Sep 17 00:00:00 2001 From: vra Date: Wed, 16 Jun 2010 17:21:39 +0530 Subject: [IMP][REF] Sql-injection changes, remove print statement, some space improvement. bzr revid: vra@tinyerp.com-20100616115139-cql5oiqf622spa6p --- addons/crm_profiling/crm_profiling.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'addons/crm_profiling') diff --git a/addons/crm_profiling/crm_profiling.py b/addons/crm_profiling/crm_profiling.py index 760c9b20bba..a14741415ea 100644 --- a/addons/crm_profiling/crm_profiling.py +++ b/addons/crm_profiling/crm_profiling.py @@ -33,7 +33,7 @@ def _get_answers(cr, uid, ids): query = """ select distinct(answer) from profile_question_yes_rel - where profile=ANY(%s)""" + where profile IN %s""" cr.execute(query, (ids,)) ans_yes = [x[0] for x in cr.fetchall()] @@ -41,9 +41,9 @@ def _get_answers(cr, uid, ids): query = """ select distinct(answer) from profile_question_no_rel - where profile=ANY(%s)""" + where profile IN %s""" - cr.execute(query, (ids,)) + cr.execute(query, (tuple(ids),)) ans_no = [x[0] for x in cr.fetchall()] return [ans_yes, ans_no] @@ -61,7 +61,7 @@ def _get_parents(cr, uid, ids): select distinct(parent_id) from crm_segmentation where parent_id is not null - and id=ANY(%s)""",(ids,)) + and id IN %s""",(tuple(ids),)) parent_ids = [x[0] for x in cr.fetchall()] -- cgit v1.2.3 From 5b6099b05f1bae2aeaca11ee2438237955b00cac Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Fri, 18 Jun 2010 10:28:36 +0200 Subject: [FIX] crm_profiling: query parameter bzr revid: chs@openerp.com-20100618082836-wd3ej6tobx5ukj2z --- addons/crm_profiling/crm_profiling.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/crm_profiling') diff --git a/addons/crm_profiling/crm_profiling.py b/addons/crm_profiling/crm_profiling.py index a14741415ea..86cd41c0335 100644 --- a/addons/crm_profiling/crm_profiling.py +++ b/addons/crm_profiling/crm_profiling.py @@ -35,7 +35,7 @@ def _get_answers(cr, uid, ids): from profile_question_yes_rel where profile IN %s""" - cr.execute(query, (ids,)) + cr.execute(query, (tuple(ids),)) ans_yes = [x[0] for x in cr.fetchall()] query = """ -- cgit v1.2.3