[IMP]:hr_attendance sql queries to parameterized query

[odoo/odoo.git] / addons / hr_attendance / wizard / print_attendance_error.py

diff --git a/addons/hr_attendance/wizard/print_attendance_error.py b/addons/hr_attendance/wizard/print_attendance_error.py
index 79c103c..3c461b5 100644 (file)
--- a/addons/hr_attendance/wizard/print_attendance_error.py
+++ b/addons/hr_attendance/wizard/print_attendance_error.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 ##############################################################################
-#    
+#
 #    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
@@ -15,7 +15,7 @@
 #    GNU Affero General Public License for more details.
 #
 #    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
 
@@ -41,21 +41,19 @@ _date_fields = {
 def _check_data(self, cr, uid, data, *args):
     date_from = data['form']['init_date']
     date_to = data['form']['end_date']
-    emp_ids = (','.join([str(x) for x in data['ids']]))
-                  
-    cr.execute("select id from hr_attendance where employee_id in (%s) and to_char(name,'YYYY-mm-dd')<='%s' and to_char(name,'YYYY-mm-dd')>='%s' and action in ('%s','%s') order by name" %(emp_ids, date_to, date_from, 'sign_in', 'sign_out'))
+    cr.execute("select id from hr_attendance where employee_id =ANY(%s) and to_char(name,'YYYY-mm-dd')<=%s and to_char(name,'YYYY-mm-dd')>=%s and action =ANY(%s) order by name" ,(data['ids'], date_to, date_from, ['sign_in','sign_out']))
     attendance_ids = [x[0] for x in cr.fetchall()]
     if not attendance_ids:
-        raise wizard.except_wizard(_('No Data Available'), _('No records found for your selection!'))    
-    
+        raise wizard.except_wizard(_('No Data Available'), _('No records found for your selection!'))
+
     attendance_records = pooler.get_pool(cr.dbname).get('hr.attendance').browse(cr,uid,attendance_ids)
     emp_ids = []
     for rec in attendance_records:
         if rec.employee_id.id not in emp_ids:
             emp_ids.append(rec.employee_id.id)
-    
+
     data['form']['emp_ids'] = emp_ids
-    
+
     return data['form']