From 3d76b8d4114b343ac7c4e4d8720504bba21741b9 Mon Sep 17 00:00:00 2001 From: Christophe Simonis Date: Wed, 3 Feb 2010 19:31:10 +0100 Subject: [PATCH] [FIX] avoid sql injection in sequences lp bug: https://launchpad.net/bugs/512682 fixed bzr revid: chs@tinyerp.com-20100203183110-bgqjoxtjjkvhhwq4 --- bin/addons/base/ir/ir_sequence.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bin/addons/base/ir/ir_sequence.py b/bin/addons/base/ir/ir_sequence.py index dab7bf807d1..729ee6a9590 100644 --- a/bin/addons/base/ir/ir_sequence.py +++ b/bin/addons/base/ir/ir_sequence.py @@ -71,6 +71,8 @@ class ir_sequence(osv.osv): } def get_id(self, cr, uid, sequence_id, test='id=%s', context=None): + if test not in ('id=%s', 'code=%s'): + raise ValueError('invalid test') cr.execute('SELECT id, number_next, prefix, suffix, padding FROM ir_sequence WHERE '+test+' AND active=%s FOR UPDATE', (sequence_id, True)) res = cr.dictfetchone() if res: