Remove sql injection problem

[odoo/odoo.git] / bin / addons / base / ir / ir_translation.py

diff --git a/bin/addons/base/ir/ir_translation.py b/bin/addons/base/ir/ir_translation.py
index 1169903..8e2a6d9 100644 (file)
--- a/bin/addons/base/ir/ir_translation.py
+++ b/bin/addons/base/ir/ir_translation.py
@@ -1,22 +1,21 @@
-# -*- encoding: utf-8 -*-
+# -*- coding: utf-8 -*-
 ##############################################################################
-#
-#    OpenERP, Open Source Management Solution  
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
-#    $Id$
+#    
+#    OpenERP, Open Source Management Solution
+#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
 #    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published by
-#    the Free Software Foundation, either version 3 of the License, or
-#    (at your option) any later version.
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
 #
 #    This program is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU General Public License for more details.
+#    GNU Affero General Public License for more details.
 #
-#    You should have received a copy of the GNU General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
 #
 ##############################################################################
 
@@ -79,9 +78,9 @@ class ir_translation(osv.osv):
             cr.execute('CREATE INDEX ir_translation_lts ON ir_translation (lang, type, src)')
             cr.commit()
 
-    @tools.cache(skiparg=3)
+    @tools.cache(skiparg=3, multi='ids')
     def _get_ids(self, cr, uid, name, tt, lang, ids):
-        translations = {}
+        translations = dict.fromkeys(ids, False)
         if ids:
             cr.execute('select res_id,value ' \
                     'from ir_translation ' \
@@ -92,18 +91,24 @@ class ir_translation(osv.osv):
                     (lang,tt,name))
             for res_id, value in cr.fetchall():
                 translations[res_id] = value
-        for res_id in ids:
-            if res_id not in translations:
-                translations[res_id] = False
         return translations
 
-    def _set_ids(self, cr, uid, name, tt, lang, ids, value):
+    def _set_ids(self, cr, uid, name, tt, lang, ids, value, src=None):
+        # clear the caches
+        tr = self._get_ids(cr, uid, name, tt, lang, ids)
+        for res_id in tr:
+            if tr[res_id]:
+                self._get_source.clear_cache(cr.dbname, uid, name, tt, lang, tr[res_id])
+        self._get_source.clear_cache(cr.dbname, uid, name, tt, lang)
+        self._get_ids.clear_cache(cr.dbname, uid, name, tt, lang, ids)
+
         cr.execute('delete from ir_translation ' \
                 'where lang=%s ' \
                     'and type=%s ' \
                     'and name=%s ' \
-                    'and res_id in ('+','.join(map(str,ids))+')',
+                    'and res_id in ('+','.join(map(str, ids))+')',
                 (lang,tt,name))
+        cr.commit()
         for id in ids:
             self.create(cr, uid, {
                 'lang':lang,
@@ -111,6 +116,7 @@ class ir_translation(osv.osv):
                 'name':name,
                 'res_id':id,
                 'value':value,
+                'src':src,
                 })
         return len(ids)
 
@@ -136,6 +142,33 @@ class ir_translation(osv.osv):
         res = cr.fetchone()
         trad = res and res[0] or ''
         return trad
+        
+    def create(self, cursor, user, vals, context=None):
+        if not context:
+            context = {}
+        ids = super(ir_translation, self).create(cursor, user, vals, context=context)
+        for trans_obj in self.read(cursor, user, [ids], ['name','type','res_id'], context=context):
+            self._get_source.clear_cache(cursor.dbname, user, trans_obj['name'], trans_obj['type'], lang=context.get('lang','en_US'))
+            self._get_ids.clear_cache(cursor.dbname, user, trans_obj['name'], trans_obj['type'], context.get('lang','en_US'), [trans_obj['res_id']])
+        return ids    
+
+    def write(self, cursor, user, ids, vals, context=None):
+        if not context:
+            context = {}
+        result = super(ir_translation, self).write(cursor, user, ids, vals, context=context)
+        for trans_obj in self.read(cursor, user, ids, ['name','type','res_id'], context=context):
+            self._get_source.clear_cache(cursor.dbname, user, trans_obj['name'], trans_obj['type'], lang=context.get('lang','en_US'))
+            self._get_ids.clear_cache(cursor.dbname, user, trans_obj['name'], trans_obj['type'], context.get('lang','en_US'), [trans_obj['res_id']])
+        return result
+
+    def unlink(self, cursor, user, ids, context=None):
+        if not context:
+            context = {}
+        for trans_obj in self.read(cursor, user, ids, ['name','type','res_id'], context=context):
+            self._get_source.clear_cache(cursor.dbname, user, trans_obj['name'], trans_obj['type'], lang=context.get('lang','en_US'))
+            self._get_ids.clear_cache(cursor.dbname, user, trans_obj['name'], trans_obj['type'], context.get('lang','en_US'), [trans_obj['res_id']])
+        result = super(ir_translation, self).unlink(cursor, user, ids, context=context)
+        return result    
 
 ir_translation()