[FIX] Security fixes for sql injections

[odoo/odoo.git] / addons / account_analytic_analysis / account_analytic_analysis.py

diff --git a/addons/account_analytic_analysis/account_analytic_analysis.py b/addons/account_analytic_analysis/account_analytic_analysis.py
index 742ef74..c77d9cd 100644 (file)
--- a/addons/account_analytic_analysis/account_analytic_analysis.py
+++ b/addons/account_analytic_analysis/account_analytic_analysis.py
@@ -32,31 +32,29 @@ class account_analytic_account(osv.osv):
 
     def _ca_invoiced_calc(self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
-            acc_set = ",".join(map(str, ids2))
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute("select account_analytic_line.account_id, COALESCE(sum(amount_currency),0.0) \
                     from account_analytic_line \
                     join account_analytic_journal \
                         on account_analytic_line.journal_id = account_analytic_journal.id  \
-                    where account_analytic_line.account_id =ANY(%s) \
+                    where account_analytic_line.account_id IN %s \
                         and account_analytic_journal.type = 'sale' \
-                    group by account_analytic_line.account_id" ,(ids2,))
+                    group by account_analytic_line.account_id" ,(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = round(sum,2)
                 
-        return self._compute_currency_for_level_tree(cr, uid, ids, ids2, res, acc_set, context)
+        return self._compute_currency_for_level_tree(cr, uid, ids, parent_ids, res, context)
 
     def _ca_to_invoice_calc(self, cr, uid, ids, name, arg, context={}):
         res = {}
         res2 = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             # Amount uninvoiced hours to invoice at sale price
             # Warning
             # This computation doesn't take care of pricelist !
             # Just consider list_price
-            acc_set = ",".join(map(str, ids2))
             cr.execute("""SELECT account_analytic_account.id, \
                         COALESCE(sum (product_template.list_price * \
                             account_analytic_line.unit_amount * \
@@ -73,11 +71,11 @@ class account_analytic_account(osv.osv):
                         on account_analytic_account.id = account_analytic_line.account_id \
                     JOIN hr_timesheet_invoice_factor \
                         on hr_timesheet_invoice_factor.id = account_analytic_account.to_invoice \
-                    WHERE account_analytic_account.id =ANY(%s) \
+                    WHERE account_analytic_account.id IN %s \
                         AND account_analytic_line.invoice_id is null \
                         AND account_analytic_line.to_invoice IS NOT NULL \
                         and account_analytic_journal.type in ('purchase','general') \
-                    GROUP BY account_analytic_account.id;""",(ids2,))
+                    GROUP BY account_analytic_account.id;""",(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = round(sum,2)
 
@@ -96,17 +94,17 @@ class account_analytic_account(osv.osv):
 
     def _hours_qtt_non_invoiced_calc (self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute("select account_analytic_line.account_id, COALESCE(sum(unit_amount),0.0) \
                     from account_analytic_line \
                     join account_analytic_journal \
                         on account_analytic_line.journal_id = account_analytic_journal.id \
-                    where account_analytic_line.account_id =ANY(%s) \
+                    where account_analytic_line.account_id IN %s \
                         and account_analytic_journal.type='general' \
                         and invoice_id is null \
                         AND to_invoice IS NOT NULL \
-                    GROUP BY account_analytic_line.account_id;",(ids2,))
+                    GROUP BY account_analytic_line.account_id;",(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = round(sum,2)
         for obj_id in ids:
@@ -121,15 +119,15 @@ class account_analytic_account(osv.osv):
 
     def _hours_quantity_calc(self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute("select account_analytic_line.account_id,COALESCE(SUM(unit_amount),0.0) \
                     from account_analytic_line \
                     join account_analytic_journal \
                         on account_analytic_line.journal_id = account_analytic_journal.id \
-                    where account_analytic_line.account_id =ANY(%s) \
+                    where account_analytic_line.account_id IN %s \
                         and account_analytic_journal.type='general' \
-                    GROUP BY account_analytic_line.account_id",(ids2,))
+                    GROUP BY account_analytic_line.account_id",(parent_ids,))
             ff =  cr.fetchall()
             for account_id, sum in ff:
                 res[account_id] = round(sum,2)
@@ -145,30 +143,29 @@ class account_analytic_account(osv.osv):
 
     def _total_cost_calc(self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
-            acc_set = ",".join(map(str, ids2))
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute("""select account_analytic_line.account_id,COALESCE(sum(amount_currency),0.0) \
 
                     from account_analytic_line \
                     join account_analytic_journal \
                         on account_analytic_line.journal_id = account_analytic_journal.id \
-                    where account_analytic_line.account_id =ANY(%s) \
+                    where account_analytic_line.account_id IN %s \
                         and amount<0 \
-                    GROUP BY account_analytic_line.account_id""",(ids2,))
+                    GROUP BY account_analytic_line.account_id""",(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = round(sum,2)
-        return self._compute_currency_for_level_tree(cr, uid, ids, ids2, res, acc_set, context)
+        return self._compute_currency_for_level_tree(cr, uid, ids, parent_ids, res, context)
  
     # TODO Take care of pricelist and purchase !
     def _ca_theorical_calc(self, cr, uid, ids, name, arg, context={}):
         res = {}
         res2 = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
         # Warning
         # This computation doesn't take care of pricelist !
         # Just consider list_price
-        if ids2:
+        if parent_ids:
             cr.execute("""select account_analytic_line.account_id as account_id, \
                         COALESCE(sum((account_analytic_line.unit_amount * pt.list_price) \
                             - (account_analytic_line.unit_amount * pt.list_price \
@@ -184,10 +181,10 @@ class account_analytic_account(osv.osv):
                         on (a.id=account_analytic_line.account_id) \
                     join hr_timesheet_invoice_factor hr \
                         on (hr.id=a.to_invoice) \
-                where account_analytic_line.account_id =ANY(%s) \
+                where account_analytic_line.account_id IN %s \
                     and a.to_invoice IS NOT NULL \
                     and account_analytic_journal.type in ('purchase','general')
-                GROUP BY account_analytic_line.account_id""",(ids2,))
+                GROUP BY account_analytic_line.account_id""",(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res2[account_id] = round(sum,2)
                 
@@ -207,13 +204,13 @@ class account_analytic_account(osv.osv):
 
     def _last_worked_date_calc (self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute("select account_analytic_line.account_id, max(date) \
                     from account_analytic_line \
-                    where account_id =ANY(%s) \
+                    where account_id IN %s \
                         and invoice_id is null \
-                    GROUP BY account_analytic_line.account_id" ,(ids2,))
+                    GROUP BY account_analytic_line.account_id" ,(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = sum
         for obj_id in ids:
@@ -228,16 +225,16 @@ class account_analytic_account(osv.osv):
 
     def _last_invoice_date_calc (self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute ("select account_analytic_line.account_id, \
                         date(max(account_invoice.date_invoice)) \
                     from account_analytic_line \
                     join account_invoice \
                         on account_analytic_line.invoice_id = account_invoice.id \
-                    where account_analytic_line.account_id =ANY(%s) \
+                    where account_analytic_line.account_id IN %s \
                         and account_analytic_line.invoice_id is not null \
-                    GROUP BY account_analytic_line.account_id",(ids2,))
+                    GROUP BY account_analytic_line.account_id",(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = sum
         for obj_id in ids:
@@ -252,13 +249,13 @@ class account_analytic_account(osv.osv):
 
     def _last_worked_invoiced_date_calc (self, cr, uid, ids, name, arg, context={}):
         res = {}
-        ids2 = self.search(cr, uid, [('parent_id', 'child_of', ids)])
-        if ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+        if parent_ids:
             cr.execute("select account_analytic_line.account_id, max(date) \
                     from account_analytic_line \
-                    where account_id =ANY(%s) \
+                    where account_id IN %s \
                         and invoice_id is not null \
-                    GROUP BY account_analytic_line.account_id;",(ids2,))
+                    GROUP BY account_analytic_line.account_id;",(parent_ids,))
             for account_id, sum in cr.fetchall():
                 res[account_id] = sum
         for obj_id in ids:
@@ -346,10 +343,10 @@ class account_analytic_account(osv.osv):
     def _month(self, cr, uid, ids, name, arg, context=None):
         res = {}
         for id in ids:
-            ids2 = self.search(cr, uid, [('parent_id', 'child_of', [id])])
-            if ids2:
+            parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+            if parent_ids:
                 cr.execute('SELECT DISTINCT(month_id) FROM account_analytic_analysis_summary_month ' \
-                        'WHERE account_id =ANY(%s) AND unit_amount <> 0.0',(ids2,))
+                        'WHERE account_id IN %s AND unit_amount <> 0.0',(parent_ids,))
                 res[id] = [int(id * 1000000 + int(x[0])) for x in cr.fetchall()]
             else:
                 res[id] = []
@@ -360,10 +357,10 @@ class account_analytic_account(osv.osv):
         cr.execute('SELECT MAX(id) FROM res_users')
         max_user = cr.fetchone()[0]
         for id in ids:
-            ids2 = self.search(cr, uid, [('parent_id', 'child_of', [id])])
-            if ids2:
+            parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
+            if parent_ids:
                 cr.execute('SELECT DISTINCT("user") FROM account_analytic_analysis_summary_user ' \
-                        'WHERE account_id =ANY(%s) AND unit_amount <> 0.0',(ids2,))
+                        'WHERE account_id IN %s AND unit_amount <> 0.0',(parent_ids,))
                 res[id] = [int((id * max_user) + x[0]) for x in cr.fetchall()]
             else:
                 res[id] = []
@@ -405,12 +402,12 @@ class account_analytic_account_summary_user(osv.osv):
         max_user = cr.fetchone()[0]
         account_ids = [int(str(x/max_user - (x%max_user == 0 and 1 or 0))) for x in ids]
         user_ids = [int(str(x-((x/max_user - (x%max_user == 0 and 1 or 0)) *max_user))) for x in ids]
-        account_ids2 = account_obj.search(cr, uid, [('parent_id', 'child_of', account_ids)])
-        if account_ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', account_ids)]))
+        if parent_ids:
             cr.execute('SELECT id, unit_amount ' \
                     'FROM account_analytic_analysis_summary_user ' \
-                    'WHERE account_id =ANY(%s) ' \
-                        'AND "user" =ANY(%s)',(account_ids2, user_ids,))
+                    'WHERE account_id IN %s ' \
+                        'AND "user" IN %s',(parent_ids, user_ids,))
             for sum_id, unit_amount in cr.fetchall():
                 res[sum_id] = unit_amount
         for obj_id in ids:
@@ -570,12 +567,12 @@ class account_analytic_account_summary_month(osv.osv):
         account_obj = self.pool.get('account.analytic.account')
         account_ids = [int(str(int(x))[:-6]) for x in ids]
         month_ids = [int(str(int(x))[-6:]) for x in ids]
-        account_ids2 = account_obj.search(cr, uid, [('parent_id', 'child_of', account_ids)])
-        if account_ids2:
+        parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', account_ids)]))
+        if parent_ids:
             cr.execute('SELECT id, unit_amount ' \
                     'FROM account_analytic_analysis_summary_month ' \
-                    'WHERE account_id =ANY(%s) ' \
-                        'AND month_id =ANY(%s) ',(account_ids2, month_ids,))
+                    'WHERE account_id IN %s ' \
+                        'AND month_id IN %s ',(parent_ids, month_ids,))
             for sum_id, unit_amount in cr.fetchall():
                 res[sum_id] = unit_amount
         for obj_id in ids: