From 4a07e497da6f43b99e701301fff90ec4fb64a4d0 Mon Sep 17 00:00:00 2001 From: "dle@openerp.com" <> Date: Tue, 18 Dec 2012 11:25:01 +0100 Subject: [PATCH] =?UTF-8?q?[FIX]Prevent=20sql=20injection=C2=B2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bzr revid: dle@openerp.com-20121218102501-mguye0rnkl0yjgm1 --- addons/l10n_be_coda/wizard/account_coda_import.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/l10n_be_coda/wizard/account_coda_import.py b/addons/l10n_be_coda/wizard/account_coda_import.py index e0c0be40c8c..33ab9a64aa0 100644 --- a/addons/l10n_be_coda/wizard/account_coda_import.py +++ b/addons/l10n_be_coda/wizard/account_coda_import.py @@ -92,9 +92,9 @@ class account_coda_import(osv.osv_memory): statement['journal_id'] = False statement['bank_account'] = False if len(statement['acc_number']) >= 12: - cr.execute("select id from res_partner_bank where replace(acc_number,' ','') like '%%%s%%'" % statement['acc_number']) + cr.execute("select id from res_partner_bank where replace(acc_number,' ','') like %s", ('%' + statement['acc_number'] + '%',)) else: - cr.execute("select id from res_partner_bank where replace(acc_number,' ','') = '%s'" % statement['acc_number']) + cr.execute("select id from res_partner_bank where replace(acc_number,' ','') = %s", (statement['acc_number'],)) bank_ids = [id[0] for id in cr.fetchall()] if bank_ids and len(bank_ids) > 0: bank_accs = self.pool.get('res.partner.bank').browse(cr, uid, bank_ids)