[FIX] avoid sql injection in sequences

lp bug: https://launchpad.net/bugs/512682 fixed bzr revid: chs@tinyerp.com-20100203183255-21lh44tfloc01wqw
2010-02-03 19:32:55 +01:00
parent 3d76b8d411
commit 3ff98ce1d9
1 changed files with 2 additions and 0 deletions
@@ -44,6 +44,8 @@ class ir_sequence(osv.osv):
        'fiscal_ids' : fields.one2many('account.sequence.fiscalyear', 'sequence_main_id', 'Sequences')
    }
    def get_id(self, cr, uid, sequence_id, test='id=%s', context={}):
+        if test not in ('id=%s', 'code=%s'):
+            raise ValueError('invalid test')
        cr.execute('select id from ir_sequence where '+test+' and active=%s', (sequence_id, True,))
        res = cr.dictfetchone()
        if res: