From eaccecd6cc2e21753240b44a42a2040d82de0fe1 Mon Sep 17 00:00:00 2001 From: Damien Bouvy Date: Thu, 30 Jan 2020 15:31:19 +0000 Subject: [PATCH] [IMP] base: correctly escape identifiers in reflection queries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the db reflects the python models at startup, a query is generated to update various `ir` models (models, fields, etc.). This query did not properly escape identifiers, preventing the use of the 'order' field name on ir.model because it is a reserved keyword in SQL and wasn't escaped. This commit introduces proper escaping for these reflection queries. Co-Authored-By: Raphaël Collet --- odoo/addons/base/models/ir_model.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/odoo/addons/base/models/ir_model.py b/odoo/addons/base/models/ir_model.py index 8056c35cf03..7d7a93d7f87 100644 --- a/odoo/addons/base/models/ir_model.py +++ b/odoo/addons/base/models/ir_model.py @@ -47,8 +47,8 @@ def query_insert(cr, table, rows): rows = [rows] cols = list(rows[0]) query = INSERT_QUERY.format( - table=table, - cols=",".join(cols), + table='"{}"'.format(table), + cols=",".join(['"{}"'.format(col) for col in cols]), rows=",".join("%s" for row in rows), ) params = [tuple(row[col] for col in cols) for row in rows] @@ -61,9 +61,9 @@ def query_update(cr, table, values, selectors): """ setters = set(values) - set(selectors) query = UPDATE_QUERY.format( - table=table, - assignment=",".join("{0}=%({0})s".format(s) for s in setters), - condition=" AND ".join("{0}=%({0})s".format(s) for s in selectors), + table='"{}"'.format(table), + assignment=",".join('"{0}"=%({0})s'.format(s) for s in setters), + condition=" AND ".join('"{0}"=%({0})s'.format(s) for s in selectors), ) cr.execute(query, values) return [row[0] for row in cr.fetchall()]