From b7f6bc4c8e2996b7ffdb881835ccb0b9d4f556d1 Mon Sep 17 00:00:00 2001 From: "HDA (OpenERP)" Date: Wed, 21 Oct 2009 12:54:49 +0530 Subject: Remove sql injection problem lp bug: https://launchpad.net/bugs/429327 fixed bzr revid: hda@tinyerp.com-20091021072449-rc9usc422tb0kv2f --- addons/document/document.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/document/document.py') diff --git a/addons/document/document.py b/addons/document/document.py index 8c88be59858..10b49ecabe9 100644 --- a/addons/document/document.py +++ b/addons/document/document.py @@ -301,7 +301,7 @@ class document_directory(osv.osv): def _check_recursion(self, cr, uid, ids): level = 100 while len(ids): - cr.execute('select distinct parent_id from document_directory where id in ('+','.join(map(str,ids))+')') + cr.execute('select distinct parent_id from document_directory where id in ('+','.join(map(str, ids))+')') ids = filter(None, map(lambda x:x[0], cr.fetchall())) if not level: return False @@ -523,7 +523,7 @@ class document_file(osv.osv): def _data_get(self, cr, uid, ids, name, arg, context): result = {} - cr.execute('select id,store_fname,link from ir_attachment where id in ('+','.join(map(str,ids))+')') + cr.execute('select id,store_fname,link from ir_attachment where id in ('+','.join(map(str, ids))+')') for id,r,l in cr.fetchall(): try: value = file(os.path.join(self._get_filestore(cr), r), 'rb').read() -- cgit v1.2.3