From 3ff98ce1d9f59ea7045865b619ef78cb19c7b933 Mon Sep 17 00:00:00 2001
From: Christophe Simonis <chs@tinyerp.com>
Date: Wed, 3 Feb 2010 19:32:55 +0100
Subject: [PATCH] [FIX] avoid sql injection in sequences

lp bug: https://launchpad.net/bugs/512682 fixed

bzr revid: chs@tinyerp.com-20100203183255-21lh44tfloc01wqw
---
 addons/account/sequence.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/addons/account/sequence.py b/addons/account/sequence.py
index 02af766a7d7..8b38fe19690 100644
--- a/addons/account/sequence.py
+++ b/addons/account/sequence.py
@@ -44,6 +44,8 @@ class ir_sequence(osv.osv):
         'fiscal_ids' : fields.one2many('account.sequence.fiscalyear', 'sequence_main_id', 'Sequences')
     }
     def get_id(self, cr, uid, sequence_id, test='id=%s', context={}):
+        if test not in ('id=%s', 'code=%s'):
+            raise ValueError('invalid test')
         cr.execute('select id from ir_sequence where '+test+' and active=%s', (sequence_id, True,))
         res = cr.dictfetchone()
         if res: