[FIX] Security fixes for sql injections
[odoo/odoo.git] / addons / auction / report / catalog2.py
1 # -*- coding: utf-8 -*-
2 ##############################################################################
3 #
4 #    OpenERP, Open Source Management Solution
5 #    Copyright (C) 2004-2010 Tiny SPRL (<http://tiny.be>).
6 #
7 #    This program is free software: you can redistribute it and/or modify
8 #    it under the terms of the GNU Affero General Public License as
9 #    published by the Free Software Foundation, either version 3 of the
10 #    License, or (at your option) any later version.
11 #
12 #    This program is distributed in the hope that it will be useful,
13 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
14 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 #    GNU Affero General Public License for more details.
16 #
17 #    You should have received a copy of the GNU Affero General Public License
18 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 #
20 ##############################################################################
21
22 import datetime
23 import time
24 from report.interface import report_rml
25 from report.interface import toxml
26 import pooler
27 from osv import osv,orm
28 from time import strptime
29 from xml.dom import minidom
30 import sys
31 import os
32 import re
33 import netsvc
34 import base64
35 import wizard
36 import photo_shadow
37 from tools import config
38
39 def _to_unicode(s):
40     try:
41         return s.decode('utf-8')
42     except UnicodeError:
43         try:
44             return s.decode('latin')
45         except UnicodeError:
46             try:
47                 return s.encode('ascii')
48             except UnicodeError:
49                 return s
50
51 def _to_decode(s):
52     try:
53         return s.encode('utf-8')
54     except UnicodeError:
55         try:
56             return s.encode('latin')
57         except UnicodeError:
58             try:
59                 return s.decode('ascii')
60             except UnicodeError:
61                 return s
62
63
64 class auction_catalog(report_rml):
65
66     def create_xml(self, cr, uid, ids, data, context):
67
68         xml = self.catalog_xml(cr, uid, ids, data, context)
69         temp=self.post_process_xml_data(cr, uid, xml, context)
70
71         return temp
72     def catalog_xml(self,cr,uid,ids,data,context,cwid="0"):
73         impl = minidom.getDOMImplementation()
74
75         doc = impl.createDocument(None, "report", None)
76
77         catalog=doc.createElement('catalog')
78         doc.documentElement.appendChild(catalog)
79
80
81         infodb='info'
82         commdb='comm'
83         tab_avoid = []
84         tab_no_photo=[]
85         for id in ids:
86             lot_ids=pooler.get_pool(cr.dbname).get('auction.lots').search(cr, uid, [('auction_id', '=', id)])
87             ab=pooler.get_pool(cr.dbname).get('auction.lots').read(cr,uid,lot_ids,['auction_id','name','lot_num','lot_est1','lot_est2'],context)
88             auction_dates_ids = [x["auction_id"][0] for x in ab]
89
90             res=pooler.get_pool(cr.dbname).get('auction.dates').read(cr,uid,ids,['name','auction1','auction2'],context)
91             # name emelment
92             key = 'name'
93             categ = doc.createElement(key)
94             categ.appendChild(doc.createTextNode(_to_decode(res[0]["name"])))
95             catalog.appendChild(categ)
96
97              #Auctuion Date element
98             categ = doc.createElement("AuctionDate1")
99             categ.appendChild(doc.createTextNode(_to_decode(res[0]['auction1'])))
100             catalog.appendChild(categ)
101
102             # Action Date 2 element
103             categ = doc.createElement("AuctionDate2")
104             categ.appendChild(doc.createTextNode(_to_decode(res[0]['auction2'])))
105             catalog.appendChild(categ)
106
107     #         promotion element
108             promo = doc.createElement('promotion1')
109
110             fp = file(config['addons_path']+'/auction/report/images/flagey_logo.jpg','r')
111             file_data = fp.read()
112             promo.appendChild(doc.createTextNode(base64.encodestring(file_data)))
113             catalog.appendChild(promo)
114             promo = doc.createElement('promotion2')
115             fp = file(config['addons_path']+'/auction/report/images/flagey_logo.jpg','r')
116             file_data = fp.read()
117             promo.appendChild(doc.createTextNode(base64.encodestring(file_data)))
118             catalog.appendChild(promo)
119
120             #product element
121             products = doc.createElement('products')
122             catalog.appendChild(products)
123             side = 0
124             length = 0
125             auction_ids = []
126             for test in ab:
127                 if test.has_key('auction_id'):
128                     auction_ids.append(test['auction_id'][0])
129             cr.execute('select * from auction_lots where auction_id IN %s',(tuple(auction_ids),))
130             res = cr.dictfetchall()
131             for cat in res:
132                 product =doc.createElement('product')
133                 products.appendChild(product)
134                 if cat['obj_desc']:
135                     infos = doc.createElement('infos')
136                     lines = re.split('<br/>|\n', _to_unicode(cat['obj_desc']))
137                     for line in lines:
138                         xline = doc.createElement('info')
139                         xline.appendChild(doc.createTextNode(_to_decode(line)))
140                         infos.appendChild(xline)
141                     product.appendChild(infos)
142                     if cat['lot_num']:
143                         lnum = doc.createElement('lot_num')
144                         lnum.appendChild(doc.createTextNode(_to_decode(str(cat['lot_num']))))
145                         infos.appendChild(lnum)
146
147                     if cat['image']:
148                         import random
149                         import tempfile
150                         limg = doc.createElement('photo_small')
151
152                         file_name = tempfile.mktemp(prefix='openerp_auction_', suffix='.jpg')
153                         fp = file(file_name, 'w')
154                         content = base64.decodestring(cat['image'])
155                         fp.write(content)
156                         fp.close()
157                         fp = file(file_name,'r')
158                         test_file_name = tempfile.mktemp(prefix='openerp_auction_test_', suffix='.jpg')
159                         size = photo_shadow.convert_catalog(fp, test_file_name,110)
160                         fp = file(test_file_name)
161                         file_data = fp.read()
162                         test_data = base64.encodestring(file_data)
163                         fp.close()
164                         limg.appendChild(doc.createTextNode(test_data))
165                         infos.appendChild(limg)
166
167                 for key in ('lot_est1','lot_est2'):
168                     ref2 = doc.createElement(key)
169                     ref2.appendChild(doc.createTextNode( _to_decode(str(cat[key] or 0.0))))
170                     product.appendChild(ref2)
171                 oldlength = length
172                 length += 2.0
173                 if length>23.7:
174                     side += 1
175                     length = length - oldlength
176                     ref3 = doc.createElement('newpage')
177                     ref3.appendChild(doc.createTextNode( "1" ))
178                     product.appendChild(ref3)
179                 if side%2:
180                     ref4 = doc.createElement('side')
181                     ref4.appendChild(doc.createTextNode( "1" ))
182                     product.appendChild(ref4)
183                 xml1 = doc.toxml()
184         return xml1
185 auction_catalog('report.auction.cat_flagy', 'auction.dates','','addons/auction/report/catalog2.xsl')
186
187 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
188