From ad4f44dfb7c98df1d92b545f3945e165d53296ca Mon Sep 17 00:00:00 2001 From: "nch@tinyerp.com" <> Date: Thu, 26 Nov 2009 17:50:57 +0530 Subject: [PATCH] [IMP]:event_project sql queries to parameterized query bzr revid: nch@tinyerp.com-20091126122057-7rbcaa5nz7a3t9ty --- addons/event_project/event.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/addons/event_project/event.py b/addons/event_project/event.py index 055253ef3ec..98f5e2420eb 100644 --- a/addons/event_project/event.py +++ b/addons/event_project/event.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- ############################################################################## -# +# # OpenERP, Open Source Management Solution # Copyright (C) 2004-2009 Tiny SPRL (). # @@ -15,7 +15,7 @@ # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . +# along with this program. If not, see . # ############################################################################## @@ -36,8 +36,8 @@ class one2many_mod_task(fields.one2many): for id in ids: res[id] = [] for id in ids: - query = "select project_id from event_event where id = %i" %id - cr.execute(query) + query = "select project_id from event_event where id = %s" + cr.execute(query,(id,)) project_ids = [ x[0] for x in cr.fetchall()] ids2 = obj.pool.get(self._obj).search(cr, user, [(self._fields_id,'in',project_ids),('state','<>','done')], limit=self._limit) for r in obj.pool.get(self._obj)._read_flat(cr, user, ids2, [self._fields_id], context=context, load='_classic_write'):