Remove sql injection problem

[odoo/odoo.git] / bin / addons / base / res / partner / partner.py

diff --git a/bin/addons/base/res/partner/partner.py b/bin/addons/base/res/partner/partner.py
index 22314cb..82acd80 100644 (file)
--- a/bin/addons/base/res/partner/partner.py
+++ b/bin/addons/base/res/partner/partner.py
@@ -1,22 +1,21 @@
-# -*- encoding: utf-8 -*-
+# -*- coding: utf-8 -*-
 ##############################################################################
-#
+#    
 #    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
-#    $Id$
+#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
 #    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published by
-#    the Free Software Foundation, either version 3 of the License, or
-#    (at your option) any later version.
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
 #
 #    This program is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU General Public License for more details.
+#    GNU Affero General Public License for more details.
 #
-#    You should have received a copy of the GNU General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
 #
 ##############################################################################
 
@@ -26,18 +25,19 @@ from osv import fields,osv
 import tools
 import ir
 import pooler
+from tools.translate import _
 
 class res_partner_function(osv.osv):
     _name = 'res.partner.function'
     _description = 'Function of the contact'
     _columns = {
         'name': fields.char('Function Name', size=64, required=True),
-        'code': fields.char('Code', size=8),
-        'ref':fields.char('Notes', size=32, required=True),
+        'code': fields.char('Code', size=8, required=True),
+        'ref':fields.char('Notes', size=32,),
     }
     _order = 'name'
     _sql_constraints = [
-        ('ref_uniq', 'unique (ref)', 'The Notes of the Partner Function must be unique !')
+        ('code_uniq', 'unique (code)', 'The Code of the Partner Function must be unique !')
     ]
 res_partner_function()
 
@@ -70,7 +70,7 @@ class res_partner_category(osv.osv):
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from res_partner_category where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select distinct parent_id from res_partner_category where id in ('+','.join(map(str, ids))+')')
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
@@ -124,6 +124,8 @@ def _lang_get(self, cr, uid, context={}):
     return [(r['code'], r['name']) for r in res] + [('','')]
 
 
+
+
 class res_partner(osv.osv):
     _description='Partner'
     _name = "res.partner"
@@ -163,14 +165,9 @@ class res_partner(osv.osv):
         'customer': lambda *a: 1,
         'category_id': _default_category,
     }
-    _sql_constraints = [
-        ('name_uniq', 'unique (name)', 'The name of the partner must be unique !')
-    ]
-
     def copy(self, cr, uid, id, default=None, context={}):
-        print 'XXXXXXXXXXXXXXXXXXXXXX : ', self.browse(cr, uid, id, fields_process=['name']).name
         name = self.read(cr, uid, [id], ['name'])[0]['name']
-        default.update({'name': name+' (copy)'})
+        default.update({'name': name+' (copy)', 'events':[]})
         return super(res_partner, self).copy(cr, uid, id, default, context)
 
     def _check_ean_key(self, cr, uid, ids):
@@ -237,7 +234,7 @@ class res_partner(osv.osv):
         return True
 
     def address_get(self, cr, uid, ids, adr_pref=['default']):
-        cr.execute('select type,id from res_partner_address where partner_id in ('+','.join(map(str,ids))+')')
+        cr.execute('select type,id from res_partner_address where partner_id in ('+','.join(map(str,map(int, ids)))+')')
         res = cr.fetchall()
         adr = dict(res)
         # get the id of the (first) default address if there is one,
@@ -309,7 +306,7 @@ class res_partner_address(osv.osv):
             return []
         res = []
         for r in self.read(cr, user, ids, ['name','zip','city','partner_id', 'street']):
-            if context.get('contact_display', 'contact')=='partner':
+            if context.get('contact_display', 'contact')=='partner' and r['partner_id']:
                 res.append((r['id'], r['partner_id'][1]))
             else:
                 addr = r['name'] or ''
@@ -327,7 +324,10 @@ class res_partner_address(osv.osv):
         if context.get('contact_display', 'contact')=='partner':
             ids = self.search(cr, user, [('partner_id',operator,name)], limit=limit, context=context)
         else:
-            ids = self.search(cr, user, [('zip','=',name)] + args, limit=limit, context=context)
+            if not name:
+                ids = self.search(cr, user, args, limit=limit, context=context)
+            else:
+                ids = self.search(cr, user, [('zip','=',name)] + args, limit=limit, context=context)
             if not ids:
                 ids = self.search(cr, user, [('city',operator,name)] + args, limit=limit, context=context)
             if name: