pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX]Prevent sql injection and remove print

Browse Source 
bzr revid: dle@openerp.com-20121218100500-fd1j2rr5flfzgrse
This commit is contained in:
dle@openerp.com
2012-12-18 11:05:00 +01:00
parent 2810ca9c31
commit 9e0df9b5d1
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/l10n_be_coda/wizard/account_coda_import.py
+2 -3
View File
@@ -92,11 +92,10 @@ class account_coda_import(osv.osv_memory):
statement['journal_id'] = False
statement['bank_account'] = False
if len(statement['acc_number']) >= 12:
cr.execute("select id from res_partner_bank where replace(acc_number,' ','') like '%" + statement['acc_number'] + "%'")
cr.execute("select id from res_partner_bank where replace(acc_number,' ','') like '%%%s%%'" % statement['acc_number'])
else:
cr.execute("select id from res_partner_bank where replace(acc_number,' ','') = '" + statement['acc_number'] + "'")
cr.execute("select id from res_partner_bank where replace(acc_number,' ','') = '%s'" % statement['acc_number'])
bank_ids = [id[0] for id in cr.fetchall()]
print bank_ids
if bank_ids and len(bank_ids) > 0:
bank_accs = self.pool.get('res.partner.bank').browse(cr, uid, bank_ids)
for bank_acc in bank_accs: