From 9e0df9b5d15e85e87f1f5473f956b2663e27bac2 Mon Sep 17 00:00:00 2001 From: "dle@openerp.com" <> Date: Tue, 18 Dec 2012 11:05:00 +0100 Subject: [PATCH] [FIX]Prevent sql injection and remove print bzr revid: dle@openerp.com-20121218100500-fd1j2rr5flfzgrse --- addons/l10n_be_coda/wizard/account_coda_import.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/addons/l10n_be_coda/wizard/account_coda_import.py b/addons/l10n_be_coda/wizard/account_coda_import.py index 865d096a71d..e0c0be40c8c 100644 --- a/addons/l10n_be_coda/wizard/account_coda_import.py +++ b/addons/l10n_be_coda/wizard/account_coda_import.py @@ -92,11 +92,10 @@ class account_coda_import(osv.osv_memory): statement['journal_id'] = False statement['bank_account'] = False if len(statement['acc_number']) >= 12: - cr.execute("select id from res_partner_bank where replace(acc_number,' ','') like '%" + statement['acc_number'] + "%'") + cr.execute("select id from res_partner_bank where replace(acc_number,' ','') like '%%%s%%'" % statement['acc_number']) else: - cr.execute("select id from res_partner_bank where replace(acc_number,' ','') = '" + statement['acc_number'] + "'") + cr.execute("select id from res_partner_bank where replace(acc_number,' ','') = '%s'" % statement['acc_number']) bank_ids = [id[0] for id in cr.fetchall()] - print bank_ids if bank_ids and len(bank_ids) > 0: bank_accs = self.pool.get('res.partner.bank').browse(cr, uid, bank_ids) for bank_acc in bank_accs: