[FIX] Security fixes for sql injections

[odoo/odoo.git] / addons / account / project / report / inverted_analytic_balance.py

diff --git a/addons/account/project/report/inverted_analytic_balance.py b/addons/account/project/report/inverted_analytic_balance.py
index 37f469d..30703f7 100644 (file)
--- a/addons/account/project/report/inverted_analytic_balance.py
+++ b/addons/account/project/report/inverted_analytic_balance.py
@@ -38,12 +38,17 @@ class account_inverted_analytic_balance(report_sxw.rml_parse):
 
     def _lines_g(self, accounts, date1, date2):
         ids = map(lambda x: x.id, accounts)
-        self.cr.execute("SELECT aa.name AS name, aa.code AS code, sum(aal.amount) AS balance, sum(aal.unit_amount) AS quantity, aa.id AS id \
+        self.cr.execute("SELECT aa.name AS name, aa.code AS code, "
+                        "sum(aal.amount) AS balance, "
+                        "sum(aal.unit_amount) AS quantity, aa.id AS id \
                 FROM account_analytic_line AS aal, account_account AS aa \
-                WHERE (aal.general_account_id=aa.id) AND (aal.account_id =ANY(%s)) AND (date>=%s) AND (date<=%s) AND aa.active \
-                GROUP BY aal.general_account_id, aa.name, aa.code, aal.code, aa.id ORDER BY aal.code", (ids,date1,date2,))
+                WHERE (aal.general_account_id=aa.id) "
+                        "AND (aal.account_id IN %s) "
+                        "AND (date>=%s) AND (date<=%s) AND aa.active \
+                GROUP BY aal.general_account_id, aa.name, aa.code, aal.code, aa.id "
+                        "ORDER BY aal.code",
+                        (tuple(ids), date1, date2))
         res = self.cr.dictfetchall()
-
         for r in res:
             if r['balance'] > 0:
                 r['debit'] = r['balance']
@@ -58,10 +63,17 @@ class account_inverted_analytic_balance(report_sxw.rml_parse):
 
     def _lines_a(self, accounts, general_account_id, date1, date2):
         ids = map(lambda x: x.id, accounts)
-        self.cr.execute("SELECT sum(aal.amount) AS balance, sum(aal.unit_amount) AS quantity, aaa.code AS code, aaa.name AS name, account_id \
-                FROM account_analytic_line AS aal, account_analytic_account AS aaa \
-                WHERE aal.account_id=aaa.id AND aal.account_id =ANY(%s) AND aal.general_account_id=%s AND aal.date>=%s AND aal.date<=%s \
-                GROUP BY aal.account_id, general_account_id, aaa.code, aaa.name ORDER BY aal.account_id", (ids,general_account_id, date1, date2,))
+        self.cr.execute("SELECT sum(aal.amount) AS balance, "
+                        "sum(aal.unit_amount) AS quantity, "
+                        "aaa.code AS code, aaa.name AS name, account_id \
+                FROM account_analytic_line AS aal, "
+                        "account_analytic_account AS aaa \
+                WHERE aal.account_id=aaa.id AND aal.account_id IN %s "
+                        "AND aal.general_account_id=%s AND aal.date>=%s "
+                        "AND aal.date<=%s \
+                GROUP BY aal.account_id, general_account_id, aaa.code, aaa.name "
+                        "ORDER BY aal.account_id",
+                        (tuple(ids), general_account_id, date1, date2))
         res = self.cr.dictfetchall()
 
         aaa_obj = self.pool.get('account.analytic.account')
@@ -86,14 +98,14 @@ class account_inverted_analytic_balance(report_sxw.rml_parse):
         ids = map(lambda x: x.id, accounts)
         self.cr.execute("SELECT sum(amount) \
                 FROM account_analytic_line \
-                WHERE account_id =ANY(%s) AND date>=%s AND date<=%s AND amount>0", (ids,date1, date2,))
+                WHERE account_id in %s AND date>=%s AND date<=%s AND amount>0", (tuple(ids),date1, date2,))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_credit(self, accounts, date1, date2):
         ids = map(lambda x: x.id, accounts)
         self.cr.execute("SELECT -sum(amount) \
                 FROM account_analytic_line \
-                WHERE account_id =ANY(%s) AND date>=%s AND date<=%s AND amount<0", (ids,date1, date2,))
+                WHERE account_id in %s AND date>=%s AND date<=%s AND amount<0", (tuple(ids),date1, date2,))
         return self.cr.fetchone()[0] or 0.0
 
     def _sum_balance(self, accounts, date1, date2):
@@ -105,7 +117,7 @@ class account_inverted_analytic_balance(report_sxw.rml_parse):
         ids = map(lambda x: x.id, accounts)
         self.cr.execute("SELECT sum(unit_amount) \
                 FROM account_analytic_line \
-                WHERE account_id =ANY(%s) AND date>=%s AND date<=%s", (ids,date1, date2,))
+                WHERE account_id in %s AND date>=%s AND date<=%s", (tuple(ids),date1, date2,))
         return self.cr.fetchone()[0] or 0.0
 
 report_sxw.report_sxw('report.account.analytic.account.inverted.balance', 'account.analytic.account', 'addons/account/project/report/inverted_analytic_balance.rml',parser=account_inverted_analytic_balance, header=False)