From 00ffef800ab2517259541a981407d4d9d93004cb Mon Sep 17 00:00:00 2001 From: Pragya ladda Date: Thu, 23 Aug 2018 17:57:09 +0530 Subject: [PATCH] [FIX] project: fix sql injection in rating public controller --- addons/project/controllers/rating.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/project/controllers/rating.py b/addons/project/controllers/rating.py index 3343674c0e8..4e800fbafb3 100644 --- a/addons/project/controllers/rating.py +++ b/addons/project/controllers/rating.py @@ -39,7 +39,7 @@ class RatingProject(http.Controller): AND rating IN (1,5,10) GROUP BY rated_partner_id, rating, period - """ % (project_id)) + """, (project_id, )) raw_data = request.env.cr.dictfetchall()