From 4cf1362e3b98256d0d018f42acd913bc56b97a27 Mon Sep 17 00:00:00 2001 From: "JMA (OpenERP)" Date: Thu, 10 Jun 2010 19:04:19 +0530 Subject: [FIX] Security fixes for sql injections bzr revid: jma@tinyerp.com-20100610133419-fwbc1xp0xoq77n90 --- addons/idea/idea.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'addons/idea/idea.py') diff --git a/addons/idea/idea.py b/addons/idea/idea.py index 14fb24ee607..171ff85505f 100644 --- a/addons/idea/idea.py +++ b/addons/idea/idea.py @@ -66,11 +66,11 @@ class idea_idea(osv.osv): sql = """SELECT i.id, avg(v.score::integer) FROM idea_idea i LEFT OUTER JOIN idea_vote v ON i.id = v.idea_id - WHERE i.id = ANY(%s) + WHERE i.id IN %s GROUP BY i.id """ - cr.execute(sql, (ids,)) + cr.execute(sql, (tuple(ids),)) return dict(cr.fetchall()) def _vote_count(self, cr, uid, ids, name, arg, context=None): @@ -86,11 +86,11 @@ class idea_idea(osv.osv): sql = """SELECT i.id, COUNT(1) FROM idea_idea i LEFT OUTER JOIN idea_vote v ON i.id = v.idea_id - WHERE i.id = ANY(%s) + WHERE i.id IN %s GROUP BY i.id """ - cr.execute(sql, (ids,)) + cr.execute(sql, (tuple(ids),)) return dict(cr.fetchall()) def _comment_count(self, cr, uid, ids, name, arg, context=None): @@ -106,11 +106,11 @@ class idea_idea(osv.osv): sql = """SELECT i.id, COUNT(1) FROM idea_idea i LEFT OUTER JOIN idea_comment c ON i.id = c.idea_id - WHERE i.id = ANY(%s) + WHERE i.id IN %s GROUP BY i.id """ - cr.execute(sql, (ids,)) + cr.execute(sql, (tuple(ids),)) return dict(cr.fetchall()) def _vote_read(self, cr, uid, ids, name, arg, context = None): -- cgit v1.2.3