From bf8d2a73c06154918874220b8bfb1251dc614088 Mon Sep 17 00:00:00 2001 From: vra Date: Wed, 16 Jun 2010 17:21:39 +0530 Subject: [IMP][REF] Sql-injection changes, remove print statement, some space improvement. bzr revid: vra@tinyerp.com-20100616115139-cql5oiqf622spa6p --- addons/project_long_term/project_long_term.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/project_long_term/project_long_term.py') diff --git a/addons/project_long_term/project_long_term.py b/addons/project_long_term/project_long_term.py index 57fbd1abb5f..f1c40a4c8ba 100644 --- a/addons/project_long_term/project_long_term.py +++ b/addons/project_long_term/project_long_term.py @@ -45,7 +45,7 @@ class project_phase(osv.osv): next_ids = [rec.id for rec in next_ids] # iter prev_ids while prev_ids: - cr.execute('select distinct prv_phase_id from project_phase_rel where next_phase_id in ('+','.join(map(str, prev_ids))+')') + cr.execute('select distinct prv_phase_id from project_phase_rel where next_phase_id IN %s',(tuple(prev_ids),)) prv_phase_ids = filter(None, map(lambda x: x[0], cr.fetchall())) if data_phase.id in prv_phase_ids: return False @@ -55,7 +55,7 @@ class project_phase(osv.osv): prev_ids = prv_phase_ids # iter next_ids while next_ids: - cr.execute('select distinct next_phase_id from project_phase_rel where prv_phase_id in ('+','.join(map(str, next_ids))+')') + cr.execute('select distinct next_phase_id from project_phase_rel where prv_phase_id IN %s',(tuple(next_ids),)) next_phase_ids = filter(None, map(lambda x: x[0], cr.fetchall())) if data_phase.id in next_phase_ids: return False -- cgit v1.2.3