Remove sql injection problem

[odoo/odoo.git] / bin / addons / base / res / partner / partner.py

diff --git a/bin/addons/base/res/partner/partner.py b/bin/addons/base/res/partner/partner.py
index 72f06c0..82acd80 100644 (file)
--- a/bin/addons/base/res/partner/partner.py
+++ b/bin/addons/base/res/partner/partner.py
@@ -1,22 +1,21 @@
-# -*- encoding: utf-8 -*-
+# -*- coding: utf-8 -*-
 ##############################################################################
-#
+#    
 #    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>). All Rights Reserved
-#    $Id$
+#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
 #    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU General Public License as published by
-#    the Free Software Foundation, either version 3 of the License, or
-#    (at your option) any later version.
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
 #
 #    This program is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU General Public License for more details.
+#    GNU Affero General Public License for more details.
 #
-#    You should have received a copy of the GNU General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
 #
 ##############################################################################
 
@@ -71,7 +70,7 @@ class res_partner_category(osv.osv):
     def _check_recursion(self, cr, uid, ids):
         level = 100
         while len(ids):
-            cr.execute('select distinct parent_id from res_partner_category where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select distinct parent_id from res_partner_category where id in ('+','.join(map(str, ids))+')')
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False
@@ -118,6 +117,15 @@ def _partner_title_get(self, cr, uid, context={}):
     res = obj.read(cr, uid, ids, ['shortcut','name'], context)
     return [(r['shortcut'], r['name']) for r in res]
 
+def _lang_get(self, cr, uid, context={}):
+    obj = self.pool.get('res.lang')
+    ids = obj.search(cr, uid, [], context=context)
+    res = obj.read(cr, uid, ids, ['code', 'name'], context)
+    return [(r['code'], r['name']) for r in res] + [('','')]
+
+
+
+
 class res_partner(osv.osv):
     _description='Partner'
     _name = "res.partner"
@@ -129,7 +137,7 @@ class res_partner(osv.osv):
         'parent_id': fields.many2one('res.partner','Main Company', select=2),
         'child_ids': fields.one2many('res.partner', 'parent_id', 'Partner Ref.'),
         'ref': fields.char('Code', size=64),
-        'lang': fields.many2one('res.lang', 'Language', help="If the selected language is loaded in the system, all documents related to this partner will be printed in this language. If not, it will be english."),
+        'lang': fields.selection(_lang_get, 'Language', size=5, help="If the selected language is loaded in the system, all documents related to this partner will be printed in this language. If not, it will be english."),
         'user_id': fields.many2one('res.users', 'Dedicated Salesman', help='The internal user that is in charge of communicating with this partner if any.'),
         'vat': fields.char('VAT',size=32 ,help="Value Added Tax number. Check the box if the partner is subjected to the VAT. Used by the VAT legal statement."),
         'bank_ids': fields.one2many('res.partner.bank', 'partner_id', 'Banks'),
@@ -226,7 +234,7 @@ class res_partner(osv.osv):
         return True
 
     def address_get(self, cr, uid, ids, adr_pref=['default']):
-        cr.execute('select type,id from res_partner_address where partner_id in ('+','.join(map(str,ids))+')')
+        cr.execute('select type,id from res_partner_address where partner_id in ('+','.join(map(str,map(int, ids)))+')')
         res = cr.fetchall()
         adr = dict(res)
         # get the id of the (first) default address if there is one,
@@ -298,7 +306,7 @@ class res_partner_address(osv.osv):
             return []
         res = []
         for r in self.read(cr, user, ids, ['name','zip','city','partner_id', 'street']):
-            if context.get('contact_display', 'contact')=='partner':
+            if context.get('contact_display', 'contact')=='partner' and r['partner_id']:
                 res.append((r['id'], r['partner_id'][1]))
             else:
                 addr = r['name'] or ''
@@ -316,7 +324,10 @@ class res_partner_address(osv.osv):
         if context.get('contact_display', 'contact')=='partner':
             ids = self.search(cr, user, [('partner_id',operator,name)], limit=limit, context=context)
         else:
-            ids = self.search(cr, user, [('zip','=',name)] + args, limit=limit, context=context)
+            if not name:
+                ids = self.search(cr, user, args, limit=limit, context=context)
+            else:
+                ids = self.search(cr, user, [('zip','=',name)] + args, limit=limit, context=context)
             if not ids:
                 ids = self.search(cr, user, [('city',operator,name)] + args, limit=limit, context=context)
             if name: