From befb3a1cd62c4071d5fc19aca368b524ff139df0 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Fri, 7 Dec 2018 09:07:59 +0000 Subject: [PATCH] [FIX] models: make valid aggregation functions explicit In `read_group`, allow an explicit set of aggregation functions. closes odoo/odoo#29348 --- odoo/models.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/odoo/models.py b/odoo/models.py index 2843ba54ecd..c62e28f1868 100644 --- a/odoo/models.py +++ b/odoo/models.py @@ -191,6 +191,12 @@ PREFETCH_MAX = 1000 LOG_ACCESS_COLUMNS = ['create_uid', 'create_date', 'write_uid', 'write_date'] MAGIC_COLUMNS = ['id'] + LOG_ACCESS_COLUMNS +# valid SQL aggregation functions +VALID_AGGREGATE_FUNCTIONS = { + 'array_agg', 'count', 'count_distinct', + 'bool_and', 'bool_or', 'max', 'min', 'avg', 'sum', +} + @pycompat.implements_to_string class BaseModel(MetaModel('DummyModel', (object,), {'_register': False})): @@ -1966,7 +1972,7 @@ class BaseModel(MetaModel('DummyModel', (object,), {'_register': False})): field = self._fields[fname] if not (field.base_field.store and field.base_field.column_type): raise UserError(_("Cannot aggregate field %r.") % fname) - if not func.isidentifier(): + if func not in VALID_AGGREGATE_FUNCTIONS: raise UserError(_("Invalid aggregation function %r.") % func) else: # we have 'name', retrieve the aggregator on the field