[fix] mrp: potential sql injection vector

bzr revid: xmo@tinyerp.com-20100223124748-a5llbwcm7or44rhu

diff --git a/addons/mrp/mrp.py b/addons/mrp/mrp.py
index 7cac4a8..15c02ab 100644 (file)
--- a/addons/mrp/mrp.py
+++ b/addons/mrp/mrp.py
@@ -216,7 +216,7 @@ class mrp_bom(osv.osv):
     def _check_recursion(self, cr, uid, ids):
         level = 500
         while len(ids):
-            cr.execute('select distinct bom_id from mrp_bom where id in ('+','.join(map(str,ids))+')')
+            cr.execute('select distinct bom_id from mrp_bom where id in %s', (tuple(ids),))
             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
             if not level:
                 return False