[FIX] Security fixes for sql injections
[odoo/odoo.git] / addons / account / wizard / account_third_party_ledger.py
1 # -*- coding: utf-8 -*-
2 ##############################################################################
3 #
4 #    OpenERP, Open Source Management Solution
5 #    Copyright (C) 2004-2010 Tiny SPRL (<http://tiny.be>).
6 #
7 #    This program is free software: you can redistribute it and/or modify
8 #    it under the terms of the GNU Affero General Public License as
9 #    published by the Free Software Foundation, either version 3 of the
10 #    License, or (at your option) any later version.
11 #
12 #    This program is distributed in the hope that it will be useful,
13 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
14 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 #    GNU Affero General Public License for more details.
16 #
17 #    You should have received a copy of the GNU Affero General Public License
18 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 #
20 ##############################################################################
21 import time
22
23 from tools.translate import _
24 from osv import fields, osv
25
26 class account_partner_ledger(osv.osv_memory):
27     """
28     This wizard will provide the partner Ledger report by periods, between any two dates.
29     """
30     _name = 'account.partner.ledger'
31     _description = 'Account Partner Ledger'
32     _columns = {
33         'company_id': fields.many2one('res.company', 'Company', required=True),
34         'state': fields.selection([('bydate','By Date'),
35                                  ('byperiod','By Period'),
36                                  ('all','By Date and Period'),
37                                  ('none','No Filter')
38                                  ],'Date/Period Filter'),
39         'fiscalyear': fields.many2one('account.fiscalyear', 'Fiscal year', help='Keep empty for all open fiscal year'),
40         'periods': fields.many2many('account.period', 'period_ledger_rel', 'report_id', 'period_id', 'Periods', help='All periods if empty', states={'none':[('readonly',True)],'bydate':[('readonly',True)]}),
41         'result_selection': fields.selection([('customer','Receivable Accounts'),
42                                               ('supplier','Payable Accounts'),
43                                               ('all','Receivable and Payable Accounts')],
44                                               'Partner', required=True),
45         'soldeinit': fields.boolean('Include initial balances'),
46         'reconcil': fields.boolean('Include Reconciled Entries'),
47         'page_split': fields.boolean('One Partner Per Page'),
48         'date1': fields.date('Start date', required=True),
49         'date2': fields.date('End date', required=True),
50             }
51
52     def _get_company(self, cr, uid, context=None):
53         user_obj = self.pool.get('res.users')
54         company_obj = self.pool.get('res.company')
55         if context is None:
56             context = {}
57         user = user_obj.browse(cr, uid, uid, context=context)
58         if user.company_id:
59             return user.company_id.id
60         else:
61             return company_obj.search(cr, uid, [('parent_id', '=', False)])[0]
62
63     _defaults={
64                'state' :  'none',
65                'date1' : time.strftime('%Y-01-01'),
66                'date2' : time.strftime('%Y-%m-%d'),
67                'result_selection' : 'all',
68                'reconcile' : True,
69                'soldeinit' : True,
70                'page_split' : False,
71                'company_id' : _get_company,
72                'fiscalyear' : False,
73                }
74
75     def check_state(self, cr, uid, ids, context=None):
76         obj_fiscalyear = self.pool.get('account.fiscalyear')
77         obj_periods = self.pool.get('account.period')
78         if context is None:
79             context = {}
80         data={}
81         data['ids'] = context.get('active_ids',[])
82         data['form'] = self.read(cr, uid, ids, [])[0]
83         data['form']['fiscalyear'] = obj_fiscalyear.find(cr, uid)
84         data['form']['periods'] = obj_periods.search(cr, uid, [('fiscalyear_id','=',data['form']['fiscalyear'])])
85         data['form']['display_account']='bal_all'
86         data['model'] = 'ir.ui.menu'
87         acc_id = self.pool.get('account.invoice').search(cr, uid, [('state','=','open')])
88         if not acc_id:
89                 raise osv.except_osv(_('No Data Available'), _('No records found for your selection!'))
90         if data['form']['state'] == 'bydate' or data['form']['state'] == 'all':
91            data['form']['fiscalyear'] = False
92         else :
93            data['form']['fiscalyear'] = True
94            return self._check_date(cr, uid, data, context)
95         if data['form']['page_split']:
96             return {
97                 'type': 'ir.actions.report.xml',
98                 'report_name': 'account.third_party_ledger',
99                 'datas': data,
100                 'nodestroy':True,
101             }
102         else:
103             return {
104                 'type': 'ir.actions.report.xml',
105                 'report_name': 'account.third_party_ledger_other',
106                 'datas': data,
107                 'nodestroy':True,
108             }
109
110     def _check_date(self, cr, uid, data, context=None):
111         if context is None:
112             context = {}
113         sql = """
114             SELECT f.id, f.date_start, f.date_stop FROM account_fiscalyear f  Where %s between f.date_start and f.date_stop """
115         cr.execute(sql, (data['form']['date1'],))
116         res = cr.dictfetchall()
117         if res:
118             if (data['form']['date2'] > res[0]['date_stop'] or data['form']['date2'] < res[0]['date_start']):
119                 raise  osv.except_osv(_('UserError'),_('Date to must be set between %s and %s') % (str(res[0]['date_start']), str(res[0]['date_stop'])))
120             else:
121                 return {
122                     'type': 'ir.actions.report.xml',
123                     'report_name': 'account.third_party_ledger',
124                     'datas': data,
125                     'nodestroy':True,
126                 }
127         else:
128             raise osv.except_osv(_('UserError'),_('Date not in a defined fiscal year'))
129
130 account_partner_ledger()
131
132 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4: