From 13ae64b05eee86d051b0be4fbac238e8c79fd0db Mon Sep 17 00:00:00 2001 From: "nch@tinyerp.com" <> Date: Fri, 27 Nov 2009 16:09:43 +0530 Subject: [PATCH] [IMP]:Auction sql queries to parameterized query bzr revid: nch@tinyerp.com-20091127103943-z5x1rujyu5wxfvkq --- addons/auction/auction.py | 14 ++++----- addons/auction/report/auction_total_rml.py | 36 +++++++++++----------- addons/auction/report/buyer_list.py | 8 ++--- addons/auction/report/catalog2.py | 8 ++--- 4 files changed, 33 insertions(+), 33 deletions(-) diff --git a/addons/auction/auction.py b/addons/auction/auction.py index 29ce8b30421..2e944207517 100644 --- a/addons/auction/auction.py +++ b/addons/auction/auction.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- ############################################################################## -# +# # OpenERP, Open Source Management Solution # Copyright (C) 2004-2009 Tiny SPRL (). # @@ -15,7 +15,7 @@ # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . +# along with this program. If not, see . # ############################################################################## @@ -95,12 +95,12 @@ class auction_dates(osv.osv): RETURN: True """ # objects vendus mais non factures - cr.execute('select count(*) as c from auction_lots where auction_id in ('+','.join(map(str, ids))+') and state=%s and obj_price>0', ('draft',)) + cr.execute('select count(*) as c from auction_lots where auction_id =ANY(%s) and state=%s and obj_price>0', (ids,'draft',)) nbr = cr.fetchone()[0] ach_uids = {} - cr.execute('select id from auction_lots where auction_id in ('+','.join(map(str, ids))+') and state=%s and obj_price>0', ('draft',)) + cr.execute('select id from auction_lots where auction_id =ANY(%s) and state=%s and obj_price>0', (ids,'draft',)) r=self.pool.get('auction.lots').lots_invoice(cr, uid, [x[0] for x in cr.fetchall()],{},None) - cr.execute('select id from auction_lots where auction_id in ('+','.join(map(str, ids))+') and obj_price>0') + cr.execute('select id from auction_lots where auction_id =ANY(%s) and obj_price>0',(ids,)) ids2 = [x[0] for x in cr.fetchall()] # for auction in auction_ids: c=self.pool.get('auction.lots').seller_trans_create(cr, uid, ids2,{}) @@ -113,7 +113,7 @@ auction_dates() # Deposits #---------------------------------------------------------- def _inv_uniq(cr, ids): - cr.execute('select name from auction_deposit where id in ('+','.join(map(lambda x: str(x), ids))+')') + cr.execute('select name from auction_deposit where id =ANY(%s)',(ids,)) for datas in cr.fetchall(): cr.execute('select count(*) from auction_deposit where name=%s', (datas[0],)) if cr.fetchone()[0]>1: @@ -229,7 +229,7 @@ def _type_get(self, cr, uid,ids): # Lots #---------------------------------------------------------- def _inv_constraint(cr, ids): - cr.execute('select id, bord_vnd_id, lot_num from auction_lots where id in ('+','.join(map(lambda x: str(x), ids))+')') + cr.execute('select id, bord_vnd_id, lot_num from auction_lots where id =ANY(%s)', (ids,)) for datas in cr.fetchall(): cr.execute('select count(*) from auction_lots where bord_vnd_id=%s and lot_num=%s', (datas[1],datas[2])) if cr.fetchone()[0]>1: diff --git a/addons/auction/report/auction_total_rml.py b/addons/auction/report/auction_total_rml.py index 15f61bc103b..646aa489ebe 100644 --- a/addons/auction/report/auction_total_rml.py +++ b/addons/auction/report/auction_total_rml.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- ############################################################################## -# +# # OpenERP, Open Source Management Solution # Copyright (C) 2004-2009 Tiny SPRL (). # @@ -15,7 +15,7 @@ # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . +# along with this program. If not, see . # ############################################################################## @@ -54,7 +54,7 @@ class auction_total_rml(report_sxw.rml_parse): for lot_id in objects: auc_lot_ids.append(lot_id.id) self.total_obj=auc_lot_ids - self.cr.execute('select auction_id from auction_lots where id in ('+','.join(map(str,auc_lot_ids))+') group by auction_id') + self.cr.execute('select auction_id from auction_lots where id =ANY(%s) group by auction_id',(auc_lot_ids,)) auc_date_ids = self.cr.fetchall() auct_dat=[] for ad_id in auc_date_ids: @@ -64,52 +64,52 @@ class auction_total_rml(report_sxw.rml_parse): def sum_taxes(self,auction_id): - self.cr.execute("select count(1) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s group by auction_id ", (auction_id,)) + self.cr.execute("select count(1) from auction_lots where id =ANY(%s) and auction_id=%s group by auction_id ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return res[0] def sold_item(self, object_id): - self.cr.execute("select count(1) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and state in ('unsold') ", (object_id,)) + self.cr.execute("select count(1) from auction_lots where id =ANY(%s) and auction_id=%s and state in ('unsold') ", (self.total_obj,object_id,)) res = self.cr.fetchone() return str(res[0]) def sum_buyer(self, auction_id): - self.cr.execute("select count(*) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and (ach_uid is not null or ach_login is not null) ", (auction_id,)) + self.cr.execute("select count(*) from auction_lots where id =ANY(%s) and auction_id=%s and (ach_uid is not null or ach_login is not null) ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) def sum_seller(self, auction_id): - self.cr.execute("select count(distinct bord_vnd_id) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s AND bord_vnd_id is not null ", (auction_id,)) + self.cr.execute("select count(distinct bord_vnd_id) from auction_lots where id =ANY(%s) and auction_id=%s AND bord_vnd_id is not null ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return res[0] def sum_adj(self, auction_id): - self.cr.execute("select sum(obj_price) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s ", (auction_id,)) + self.cr.execute("select sum(obj_price) from auction_lots where id =ANY(%s) and auction_id=%s ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) def count_take(self, auction_id): - self.cr.execute("select count(*) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and ach_emp='True' ", (auction_id,)) + self.cr.execute("select count(*) from auction_lots where id =ANY(%s) and auction_id=%s and ach_emp='True' ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) def chek_paid(self, auction_id): - self.cr.execute("select count(1) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and ((paid_ach='T') or (is_ok='T')) ", (auction_id,)) + self.cr.execute("select count(1) from auction_lots where id =ANY(%s) and auction_id=%s and ((paid_ach='T') or (is_ok='T')) ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) def check_paid_seller(self,auction_id): - self.cr.execute("select sum(seller_price) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and paid_vnd != 'T' ", (auction_id,)) + self.cr.execute("select sum(seller_price) from auction_lots where id =ANY(%s) and auction_id=%s and paid_vnd != 'T' ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) or 0.0 def sum_credit(self,auction_id): - self.cr.execute("select sum(buyer_price) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s", (auction_id,)) + self.cr.execute("select sum(buyer_price) from auction_lots where id =ANY(%s) and auction_id=%s", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) def sum_debit_buyer(self,auction_id): - self.cr.execute("select sum(buyer_price) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s", (auction_id,)) + self.cr.execute("select sum(buyer_price) from auction_lots where id =ANY(%s) and auction_id=%s", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0] or 0) @@ -121,27 +121,27 @@ class auction_total_rml(report_sxw.rml_parse): def sum_credit_seller(self, object_id): - self.cr.execute("select sum(seller_price) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s", (object_id,)) + self.cr.execute("select sum(seller_price) from auction_lots where id =ANY(%s) and auction_id=%s", (self.total_obj,object_id,)) res = self.cr.fetchone() return str(res[0] or 0) def sum_minadj(self, auction_id): - self.cr.execute('select sum(lot_est1) from auction_lots where id in ('+','.join(map(str,self.total_obj))+') and auction_id=%s', (auction_id,)) + self.cr.execute('select sum(lot_est1) from auction_lots where id =ANY(%s) and auction_id=%s', (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) or 0 def sum_maxadj(self, auction_id): - self.cr.execute('select sum(lot_est2) from auction_lots where id in ('+','.join(map(str,self.total_obj))+') and auction_id=%s', (auction_id,)) + self.cr.execute('select sum(lot_est2) from auction_lots where id =ANY(%s) and auction_id=%s', (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) or 0 def sum_buyer_paid(self, auction_id): - self.cr.execute("select count(*) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and state = 'paid' ", (auction_id,)) + self.cr.execute("select count(*) from auction_lots where id =ANY(%s) and auction_id=%s and state = 'paid' ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) def count_comm(self, auction_id): - self.cr.execute("select count(*) from auction_lots where id in ("+",".join(map(str,self.total_obj))+") and auction_id=%s and obj_comm is not null ", (auction_id,)) + self.cr.execute("select count(*) from auction_lots where id =ANY(%s) and auction_id=%s and obj_comm is not null ", (self.total_obj,auction_id,)) res = self.cr.fetchone() return str(res[0]) diff --git a/addons/auction/report/buyer_list.py b/addons/auction/report/buyer_list.py index 171c81a09f9..8726ec147a8 100644 --- a/addons/auction/report/buyer_list.py +++ b/addons/auction/report/buyer_list.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- ############################################################################## -# +# # OpenERP, Open Source Management Solution # Copyright (C) 2004-2009 Tiny SPRL (). # @@ -15,7 +15,7 @@ # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . +# along with this program. If not, see . # ############################################################################## @@ -49,7 +49,7 @@ class buyer_list(report_sxw.rml_parse): for lot_id in objects: auc_lot_ids.append(lot_id.id) self.auc_lot_ids=auc_lot_ids - self.cr.execute('select auction_id from auction_lots where id in ('+','.join(map(str,auc_lot_ids))+') group by auction_id') + self.cr.execute('select auction_id from auction_lots where id =ANY(%s) group by auction_id',(auc_lot_ids,)) auc_date_ids = self.cr.fetchall() auct_dat=[] for ad_id in auc_date_ids: @@ -70,7 +70,7 @@ class buyer_list(report_sxw.rml_parse): auc_date_ids = self.pool.get('auction.dates').search(self.cr,self.uid,([('name','like',obj['name'])])) # self.cr.execute('select ach_uid,count(1) as no_lot, sum(obj_price) as adj_price, sum(buyer_price)-sum(obj_price) as buyer_cost ,sum(buyer_price) as to_pay from auction_lots where id in ('+','.join(map(str,self.auc_lot_ids))+') and auction_id=%s and ach_uid is not null group by ach_uid ', (auc_date_ids[0],)) - self.cr.execute('select ach_login as ach_uid,count(1) as no_lot, sum(obj_price) as adj_price, sum(buyer_price)-sum(obj_price) as buyer_cost ,sum(buyer_price) as to_pay from auction_lots where id in ('+','.join(map(str,self.auc_lot_ids))+') and auction_id=%s and ach_login is not null group by ach_login order by ach_login', (auc_date_ids[0],)) + self.cr.execute('select ach_login as ach_uid,count(1) as no_lot, sum(obj_price) as adj_price, sum(buyer_price)-sum(obj_price) as buyer_cost ,sum(buyer_price) as to_pay from auction_lots where id =ANY(%s) and auction_id=%s and ach_login is not null group by ach_login order by ach_login', (self.auc_lot_ids,auc_date_ids[0],)) res = self.cr.dictfetchall() for r in res: # if r['ach_uid']: diff --git a/addons/auction/report/catalog2.py b/addons/auction/report/catalog2.py index 38493d6f6bd..d43cd0ca72e 100644 --- a/addons/auction/report/catalog2.py +++ b/addons/auction/report/catalog2.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- ############################################################################## -# +# # OpenERP, Open Source Management Solution # Copyright (C) 2004-2009 Tiny SPRL (). # @@ -15,7 +15,7 @@ # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . +# along with this program. If not, see . # ############################################################################## @@ -125,8 +125,8 @@ class auction_catalog(report_rml): auction_ids = [] for test in ab: if test.has_key('auction_id'): - auction_ids.append(str(test['auction_id'][0])) - cr.execute('select * from auction_lots where auction_id in ('+ ','.join(auction_ids)+')') + auction_ids.append(test['auction_id'][0]) + cr.execute('select * from auction_lots where auction_id =ANY(%s)',(auction_ids,)) res = cr.dictfetchall() for cat in res: product =doc.createElement('product')