[FIX] project: fix sql injection in rating public controller

2018-08-24 17:08:22 +02:00
parent bda6d60b8e
commit 00ffef800a
1 changed files with 1 additions and 1 deletions
@@ -39,7 +39,7 @@ class RatingProject(http.Controller):
                    AND rating IN (1,5,10)
            GROUP BY
                rated_partner_id, rating, period
-        """ % (project_id))
+        """, (project_id, ))

        raw_data = request.env.cr.dictfetchall()