[IMP]:account_payment sql queries to parameterized query

bzr revid: nch@tinyerp.com-20091127110243-181hk1mvg6ea34gu

diff --git a/addons/account_payment/account_move_line.py b/addons/account_payment/account_move_line.py
index eb61214..ffb6c45 100644 (file)
--- a/addons/account_payment/account_move_line.py
+++ b/addons/account_payment/account_move_line.py
@@ -42,7 +42,7 @@ class account_move_line(osv.osv):
                         WHERE move_line_id = ml.id
                         AND po.state != 'cancel') as amount
                     FROM account_move_line ml
-                    WHERE id in (%s)""" % (",".join(map(str,map(int, ids)))))
+                    WHERE id =ANY(%s)""" ,(ids,))
         r=dict(cr.fetchall())
         return r
 

diff --git a/addons/account_payment/payment.py b/addons/account_payment/payment.py
index 8d46db7..22a564d 100644 (file)
--- a/addons/account_payment/payment.py
+++ b/addons/account_payment/payment.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 ##############################################################################
-#    
+#
 #    OpenERP, Open Source Management Solution
 #    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
 #
@@ -15,7 +15,7 @@
 #    GNU Affero General Public License for more details.
 #
 #    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 ##############################################################################
 
@@ -100,7 +100,7 @@ class payment_order(osv.osv):
             ('draft', 'Draft'),
             ('open','Confirmed'),
             ('cancel','Cancelled'),
-            ('done','Done')], 'State', select=True, 
+            ('done','Done')], 'State', select=True,
             help='When an order is placed the state is \'Draft\'.\n Once the bank is confirmed the state is set to \'Confirmed\'.\n Then the order is paid the state is \'Done\'.'),
         'line_ids': fields.one2many('payment.line','order_id','Payment lines',states={'done':[('readonly',True)]}),
         'total': fields.function(_total, string="Total", method=True,
@@ -225,8 +225,8 @@ class payment_line(osv.osv):
             from account_move_line ml
                 inner join payment_line pl
                 on (ml.id = pl.move_line_id)
-            where pl.id in (%s)"""%
-            (self.translate(name), ','.join(map(str, ids))))
+            where pl.id =ANY(%s)""",
+            (self.translate(name),ids,))
         res = dict(cr.fetchall())
 
         if name == 'partner_id':