From 03c28818a4b9045a599846880be300b157f8ea4c Mon Sep 17 00:00:00 2001
From: "qdp-launchpad@tinyerp.com" <>
Date: Fri, 25 Jun 2010 10:49:06 +0200
Subject: [PATCH] [FIX] fields.py: reverted missy change that doesn't prevent
 sql injection and causes crashes

bzr revid: qdp-launchpad@tinyerp.com-20100625084906-bme05poqve5d628k
---
 bin/osv/fields.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/osv/fields.py b/bin/osv/fields.py
index 28f021d8954..433a25581ff 100644
--- a/bin/osv/fields.py
+++ b/bin/osv/fields.py
@@ -469,7 +469,7 @@ class one2many(_column):
             elif act[0] == 6:
                 obj.write(cr, user, act[2], {self._fields_id:id}, context=context or {})
                 ids2 = act[2] or [0]
-                cr.execute('select id from '+_table+' where '+self._fields_id+'=%s and id <> ALL %s', (id,tuple(ids2)))
+                cr.execute('select id from '+_table+' where '+self._fields_id+'=%s and id <> ALL (%s)', (id,ids2))
                 ids3 = map(lambda x:x[0], cr.fetchall())
                 obj.write(cr, user, ids3, {self._fields_id:False}, context=context or {})
         return result