diff --git a/addons/base_calendar/base_calendar.py b/addons/base_calendar/base_calendar.py
index 7ccd07351f0..1ff7777cf36 100644
--- a/addons/base_calendar/base_calendar.py
+++ b/addons/base_calendar/base_calendar.py
@@ -978,7 +978,7 @@ class calendar_event(osv.osv):
if not context:
context = {}
for event_id in ids:
- cr.execute('select id from %s where recurrent_uid=%s' % (self._table, event_id))
+ cr.execute("select id from %s where recurrent_uid=%%s" % (self._table), (event_id,))
r_ids = map(lambda x: x[0], cr.fetchall())
self.unlink(cr, uid, r_ids, context=context)
return True
@@ -1065,7 +1065,7 @@ class calendar_event(osv.osv):
'rule_type': rrule_type,
'id': id,
})
- cr.execute(qry, val) # Hopefully psycopg2 works with dicts. But, FIXME
+ cr.execute(qry % val)
return True
def _get_rulestring(self, cr, uid, ids, name, arg, context=None):
@@ -1438,7 +1438,8 @@ true, it will allow you to hide the event alarm information without removing it.
res = super(calendar_event, self).search(cr, uid, args_without_date, \
offset, limit, order, context, count)
- return self.get_recurrent_ids(cr, uid, res, start_date, until_date, limit)
+ res = self.get_recurrent_ids(cr, uid, res, start_date, until_date, limit)
+ return res
def write(self, cr, uid, ids, vals, context=None, check=True, update_check=True):
"""
@@ -1533,11 +1534,9 @@ true, it will allow you to hide the event alarm information without removing it.
if fields and 'date' not in fields:
fields.append('date')
- real_ids = [item2 for item1, item2 in select]
- event_values = dict([(res['id'], res) for res in super(calendar_event, self).read(cr, uid, real_ids, fields=fields, context=context, load=load)])
-
for base_calendar_id, real_id in select:
- res = event_values[real_id]
+ #REVET: Revision ID: olt@tinyerp.com-20100924131709-cqsd1ut234ni6txn
+ res = super(calendar_event, self).read(cr, uid, real_id, fields=fields, context=context, load=load)
ls = base_calendar_id2real_id(base_calendar_id, with_date=res and res.get('duration', 0) or 0)
if not isinstance(ls, (str, int, long)) and len(ls) >= 2:
res['date'] = ls[1]
diff --git a/addons/caldav/calendar.py b/addons/caldav/calendar.py
index d22fa98f6e4..068af56459f 100644
--- a/addons/caldav/calendar.py
+++ b/addons/caldav/calendar.py
@@ -63,11 +63,12 @@ def uid2openobjectid(cr, uidval, oomodel, rdate):
return (False, None)
qry = 'SELECT DISTINCT(id) FROM %s' % model_obj._table
if rdate:
- qry += " WHERE recurrent_id=%s"
- cr.execute(qry, (rdate,))
+ qry += " where recurrent_id='%s'" % (rdate) #TOFIX: sql injection
+ cr.execute(qry)
r_id = cr.fetchone()
if r_id:
return (id, r_id[0])
+
cr.execute(qry)
ids = map(lambda x: str(x[0]), cr.fetchall())
if id in ids:
diff --git a/addons/project_long_term/project_long_term.py b/addons/project_long_term/project_long_term.py
index 2caf36766b0..0c31c485753 100644
--- a/addons/project_long_term/project_long_term.py
+++ b/addons/project_long_term/project_long_term.py
@@ -92,7 +92,7 @@ class project_phase(osv.osv):
model_data_id = model_data_obj._get_id(cr, uid, 'product', 'uom_hour')
return model_data_obj.read(cr, uid, [model_data_id], ['res_id'])[0]['res_id']
- def _compute(self, cr, uid, ids, context=None):
+ def _compute(self, cr, uid, ids,field_name, arg, context=None):
res = {}
if not ids:
return res
@@ -100,9 +100,7 @@ class project_phase(osv.osv):
tot = 0.0
for task in phase.task_ids:
tot += task.planned_hours
- res[phase.id] = {
- 'total_hours' : tot
- }
+ res[phase.id] = tot
return res
_columns = {
diff --git a/addons/project_long_term/project_long_term_view.xml b/addons/project_long_term/project_long_term_view.xml
index 3412ba7ca08..fa645af4127 100644
--- a/addons/project_long_term/project_long_term_view.xml
+++ b/addons/project_long_term/project_long_term_view.xml
@@ -110,22 +110,23 @@
form