From e0d94956c1da3d5a64eb91b3a947bd5dde01c424 Mon Sep 17 00:00:00 2001 From: "Anup (OpenERP)" Date: Fri, 18 Jun 2010 15:46:41 +0530 Subject: [IMP] SQL injection Refactored bzr revid: ach@tinyerp.com-20100618101641-84cdea9n1pzx36v2 --- bin/workflow/instance.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'bin/workflow/instance.py') diff --git a/bin/workflow/instance.py b/bin/workflow/instance.py index e1407fd1455..e530d56dcd2 100644 --- a/bin/workflow/instance.py +++ b/bin/workflow/instance.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- ############################################################################## -# +# # OpenERP, Open Source Management Solution # Copyright (C) 2004-2009 Tiny SPRL (). # @@ -15,7 +15,7 @@ # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . +# along with this program. If not, see . # ############################################################################## @@ -71,7 +71,7 @@ def _update_end(cr, inst_id, ident): act_names = cr.fetchall() cr.execute("update wkf_instance set state='complete' where id=%s", (inst_id,)) cr.execute("update wkf_workitem set state='complete' where subflow_id=%s", (inst_id,)) - cr.execute("select i.id,w.osv,i.res_id from wkf_instance i left join wkf w on (i.wkf_id=w.id) where i.id in (select inst_id from wkf_workitem where subflow_id=%s)", (inst_id,)) + cr.execute("select i.id,w.osv,i.res_id from wkf_instance i left join wkf w on (i.wkf_id=w.id) where i.id IN (select inst_id from wkf_workitem where subflow_id=%s)", (inst_id,)) for i in cr.fetchall(): for act_name in act_names: validate(cr, i[0], (ident[0],i[1],i[2]), 'subflow.'+act_name[0]) -- cgit v1.2.3