From b48fb1cde6b7bbc49f502974a034ee1cf7e87e6c Mon Sep 17 00:00:00 2001 From: "uco (Open ERP)" Date: Tue, 10 Aug 2010 18:08:18 +0530 Subject: [PATCH] [IMP] point_of_sale: Improved code. Removed sql injections. bzr revid: uco@tinyerp.com-20100810123818-8c1s2ovvmlydwq8t --- .../wizard/pos_close_statement.py | 9 +---- .../wizard/pos_open_statement.py | 33 +------------------ 2 files changed, 2 insertions(+), 40 deletions(-) diff --git a/addons/point_of_sale/wizard/pos_close_statement.py b/addons/point_of_sale/wizard/pos_close_statement.py index 7d32eee568f..2ecc49e56e6 100644 --- a/addons/point_of_sale/wizard/pos_close_statement.py +++ b/addons/point_of_sale/wizard/pos_close_statement.py @@ -42,10 +42,7 @@ class pos_close_statement(osv.osv_memory): journal_obj = self.pool.get('account.journal') cr.execute("""select DISTINCT journal_id from pos_journal_users where user_id=%d order by journal_id"""%(uid)) j_ids = map(lambda x1: x1[0], cr.fetchall()) - cr.execute(""" select id from account_journal - where auto_cash='True' and type='cash' - and id in (%s)""" %(','.join(map(lambda x: "'" + str(x) + "'", j_ids)))) - journal_ids = map(lambda x1: x1[0], cr.fetchall()) + journal_ids = journal_obj.search(cr, uid, [('auto_cash', '=', True), ('type', '=', 'cash'), ('id', 'in', j_ids)]) for journal in journal_obj.browse(cr, uid, journal_ids): ids = statement_obj.search(cr, uid, [('state', '!=', 'confirm'), ('user_id', '=', uid), ('journal_id', '=', journal.id)]) @@ -55,10 +52,6 @@ class pos_close_statement(osv.osv_memory): list_statement.append(ids[0]) if not journal.check_dtls: statement_obj.button_confirm_cash(cr, uid, ids, context) - # if not list_statement: - # return {} - # model_data_ids = mod_obj.search(cr, uid,[('model','=','ir.ui.view'),('name','=','view_bank_statement_tree')], context=context) - # resource_id = mod_obj.read(cr, uid, model_data_ids, fields=['res_id'], context=context)[0]['res_id'] data_obj = self.pool.get('ir.model.data') id2 = data_obj._get_id(cr, uid, 'account', 'view_bank_statement_tree') diff --git a/addons/point_of_sale/wizard/pos_open_statement.py b/addons/point_of_sale/wizard/pos_open_statement.py index 2644e42eee9..0e3af22f2f5 100644 --- a/addons/point_of_sale/wizard/pos_open_statement.py +++ b/addons/point_of_sale/wizard/pos_open_statement.py @@ -44,22 +44,13 @@ class pos_open_statement(osv.osv_memory): journal_obj = self.pool.get('account.journal') cr.execute("""select DISTINCT journal_id from pos_journal_users where user_id=%d order by journal_id"""%(uid)) j_ids = map(lambda x1: x1[0], cr.fetchall()) - cr.execute(""" select id from account_journal - where auto_cash='True' and type='cash' - and id in (%s)""" %(','.join(map(lambda x: "'" + str(x) + "'", j_ids)))) - journal_ids = map(lambda x1: x1[0], cr.fetchall()) + journal_ids = journal_obj.search(cr, uid, [('auto_cash', '=', True), ('type', '=', 'cash'), ('id', 'in', j_ids)]) for journal in journal_obj.browse(cr, uid, journal_ids): ids = statement_obj.search(cr, uid, [('state', '!=', 'confirm'), ('user_id', '=', uid), ('journal_id', '=', journal.id)]) if len(ids): raise osv.except_osv(_('Message'), _('You can not open a Cashbox for "%s". \n Please close the cashbox related to. ' %(journal.name))) -# cr.execute(""" Select id from account_bank_statement -# where journal_id =%d -# and company_id =%d -# order by id desc limit 1""" %(journal.id, company_id)) -# st_id = cr.fetchone() - number = '' if journal.sequence_id: number = sequence_obj.get_id(cr, uid, journal.sequence_id.id) @@ -75,27 +66,6 @@ class pos_open_statement(osv.osv_memory): }) statement_obj.button_open(cr, uid, [statement_id], context) - # period = statement_obj._get_period(cr, uid, context) or None - # cr.execute("INSERT INTO account_bank_statement(journal_id,company_id,user_id,state,name, period_id,date) VALUES(%d,%d,%d,'open','%s',%d,'%s')"%(journal.id, company_id, uid, number, period, time.strftime('%Y-%m-%d %H:%M:%S'))) - # cr.commit() - # cr.execute("select id from account_bank_statement where journal_id=%d and company_id=%d and user_id=%d and state='open' and name='%s'"%(journal.id, company_id, uid, number)) - # statement_id = cr.fetchone()[0] - # print "statement_id",statement_id - # if st_id: - # statemt_id = statement_obj.browse(cr, uid, st_id[0]) - # list_statement.append(statemt_id.id) - # if statemt_id and statemt_id.ending_details_ids: - # statement_obj.write(cr, uid, [statement_id], { - # 'balance_start': statemt_id.balance_end, - # 'state': 'open', - # }) - # if statemt_id.ending_details_ids: - # for i in statemt_id.ending_details_ids: - # c = statement_obj.create(cr, uid, { - # 'pieces': i.pieces, - # 'number': i.number, - # 'starting_id': statement_id, - # }) data_obj = self.pool.get('ir.model.data') id2 = data_obj._get_id(cr, uid, 'account', 'view_bank_statement_tree') id3 = data_obj._get_id(cr, uid, 'account', 'view_bank_statement_form2') @@ -105,7 +75,6 @@ class pos_open_statement(osv.osv_memory): id3 = data_obj.browse(cr, uid, id3, context=context).res_id return { -# 'domain': "[('id','in', ["+','.join(map(str,list_statement))+"])]", 'domain': "[('state','=','open')]", 'name': 'Open Statement', 'view_type': 'form',