From 97f81a14e5080ffcac0e86ab8c5df9e494b650a0 Mon Sep 17 00:00:00 2001
From: Christophe Simonis <>
Date: Wed, 12 May 2010 14:06:56 +0530
Subject: [PATCH] =?UTF-8?q?[FIX]=C2=A0avoid=C2=A0sql=C2=A0injection=C2=A0i?=
 =?UTF-8?q?n=C2=A0sequences?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bzr revid: vra@tinyerp.com-20100512083656-bc30l9o5rbn5lh3w
---
 addons/account/sequence.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/addons/account/sequence.py b/addons/account/sequence.py
index d48f23eb1cf..9c566c8f174 100644
--- a/addons/account/sequence.py
+++ b/addons/account/sequence.py
@@ -42,7 +42,9 @@ class ir_sequence(osv.osv):
     _columns = {
         'fiscal_ids' : fields.one2many('account.sequence.fiscalyear', 'sequence_main_id', 'Sequences')
     }
-    def get_id(self, cr, uid, sequence_id, test='id', context={}):        
+    def get_id(self, cr, uid, sequence_id, test='id', context={}):
+        if test not in ('id=%s', 'code=%s'):
+            raise ValueError('invalid test')        
         cr.execute('select id from ir_sequence where '+test+'=%s and active=%s', (sequence_id, True,))
         res = cr.dictfetchone()
         if res: