[FIX] Security fixes for sql injections

[odoo/odoo.git] / addons / hr_timesheet_sheet / hr_timesheet_sheet.py

diff --git a/addons/hr_timesheet_sheet/hr_timesheet_sheet.py b/addons/hr_timesheet_sheet/hr_timesheet_sheet.py
index 5ace7f6..2eb3529 100644 (file)
--- a/addons/hr_timesheet_sheet/hr_timesheet_sheet.py
+++ b/addons/hr_timesheet_sheet/hr_timesheet_sheet.py
@@ -102,7 +102,7 @@ class hr_timesheet_sheet(osv.osv):
                 LEFT JOIN hr_timesheet_sheet_sheet_day AS day \
                     ON (sheet.id = day.sheet_id \
                         AND day.name = sheet.date_current) \
-                WHERE sheet.id =ANY(%s)',(ids,))
+                WHERE sheet.id IN %s',(tuple(ids),))
         for record in cr.fetchall():
             res[record[0]] = {}
             res[record[0]]['total_attendance_day'] = record[1]
@@ -118,7 +118,7 @@ class hr_timesheet_sheet(osv.osv):
                 FROM hr_timesheet_sheet_sheet s \
                     LEFT JOIN hr_timesheet_sheet_sheet_day d \
                         ON (s.id = d.sheet_id) \
-                WHERE s.id =ANY(%s) GROUP BY s.id',(ids,))
+                WHERE s.id IN %s GROUP BY s.id',(tuple(ids),))
         for record in cr.fetchall():
             res[record[0]] = {}
             res[record[0]]['total_attendance'] = record[1]
@@ -368,7 +368,7 @@ class hr_timesheet_line(osv.osv):
                         ON (s.date_to >= al.date \
                             AND s.date_from <= al.date \
                             AND s.user_id = al.user_id) \
-                WHERE l.id =ANY(%s) GROUP BY l.id',(ids,))
+                WHERE l.id IN %s GROUP BY l.id',(tuple(ids),))
         res = dict(cursor.fetchall())
         sheet_names = {}
         for sheet_id, name in sheet_obj.name_get(cursor, user, res.values(),
@@ -487,7 +487,7 @@ class hr_attendance(osv.osv):
                         ON (s.date_to >= date_trunc('day',a.name) \
                             AND s.date_from <= a.name \
                             AND s.user_id = r.user_id) \
-                WHERE a.id =ANY(%s) GROUP BY a.id",(ids,))
+                WHERE a.id IN %s GROUP BY a.id",(tuple(ids),))
         res = dict(cursor.fetchall())
         sheet_names = {}
         for sheet_id, name in sheet_obj.name_get(cursor, user, res.values(),