From 3ab138981416f76a5631a2e42fc73ebed593ff26 Mon Sep 17 00:00:00 2001
From: "nch@tinyerp.com" <>
Date: Thu, 26 Nov 2009 17:40:51 +0530
Subject: [PATCH] [IMP]:hr sql queries to parameterized query

bzr revid: nch@tinyerp.com-20091126121051-tm9jjybir4ei2hht
---
 addons/hr/hr.py            | 22 +++++++++++-----------
 addons/hr/hr_department.py | 12 ++++++------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/addons/hr/hr.py b/addons/hr/hr.py
index 896a2047eda..e73914c5aa3 100644
--- a/addons/hr/hr.py
+++ b/addons/hr/hr.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 ##############################################################################
-#    
+#
 #    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
@@ -15,7 +15,7 @@
 #    GNU Affero General Public License for more details.
 #
 #    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
 
@@ -91,27 +91,27 @@ hr_timesheet_group()
 class hr_employee_category(osv.osv):
     _name = "hr.employee.category"
     _description = "Employee Category"
-    
+
     _columns = {
         'name' : fields.char("Category", size=64, required=True),
         'parent_id': fields.many2one('hr.employee.category', 'Parent Category', select=True),
         'child_ids': fields.one2many('hr.employee.category', 'parent_id', 'Child Categories')
     }
-    
+
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from hr_employee_category where id in ('+','.join(map(str, ids))+')')
+            cr.execute('select distinct parent_id from hr_employee_category where id=ANY(%s)',(ids,))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
             level -= 1
         return True
-    
+
     _constraints = [
         (_check_recursion, 'Error ! You cannot create recursive Categories.', ['parent_id'])
     ]
-    
+
 hr_employee_category()
 
 class hr_employee(osv.osv):
@@ -146,21 +146,21 @@ class hr_employee(osv.osv):
     _defaults = {
         'active' : lambda *a: True,
     }
-    
+
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from hr_employee where id in ('+','.join(map(str, ids))+')')
+            cr.execute('select distinct parent_id from hr_employee where id =ANY(%s)',(ids,))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
             level -= 1
         return True
-    
+
     _constraints = [
         (_check_recursion, 'Error ! You cannot create recursive Hierarchy of Employees.', ['parent_id'])
     ]
-    
+
 hr_employee()
 
 class hr_timesheet(osv.osv):
diff --git a/addons/hr/hr_department.py b/addons/hr/hr_department.py
index 8c424fab8a6..e329f7b5991 100644
--- a/addons/hr/hr_department.py
+++ b/addons/hr/hr_department.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 ##############################################################################
-#    
+#
 #    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
@@ -15,7 +15,7 @@
 #    GNU Affero General Public License for more details.
 #
 #    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
 
@@ -43,7 +43,7 @@ class hr_department(osv.osv):
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from hr_department where id in ('+','.join(map(str, ids))+')')
+            cr.execute('select distinct parent_id from hr_department where id =ANY(%s)',(ids,))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
@@ -117,12 +117,12 @@ class res_users(osv.osv):
             ids_dept = obj_dept.search(cr, uid, [('id', 'child_of', mgnt_dept_ids)])
             if ids_dept:
                 data_dept = obj_dept.read(cr, uid, ids_dept, ['member_ids'])
-                childs = map(lambda x: x['member_ids'], data_dept)                
+                childs = map(lambda x: x['member_ids'], data_dept)
                 childs = tools.flatten(childs)
-                childs = obj_user.search(cr, uid, [('id','in',childs),('active','=',True)])                
+                childs = obj_user.search(cr, uid, [('id','in',childs),('active','=',True)])
                 if manager_id in childs:
                     childs.remove(manager_id)
-                
+
                 child_ids.extend(tools.flatten(childs))
                 set = {}
                 map(set.__setitem__, child_ids, [])