[FIX] Security Loophole corrected

lp bug: https://launchpad.net/bugs/422563 fixed

bzr revid: jvo@tinyerp.com-20090901150136-tjpngpcfixg940b6

diff --git a/bin/osv/orm.py b/bin/osv/orm.py
index 05b899a..9838c6b 100644 (file)
--- a/bin/osv/orm.py
+++ b/bin/osv/orm.py
@@ -2122,16 +2122,16 @@ class orm(orm_template):
                 if d1:
                     cr.execute('SELECT %s FROM \"%s\" WHERE id IN (%s) AND %s ORDER BY %s' % \
                             (','.join(fields_pre2 + ['id']), self._table,
-                                ','.join([str(x) for x in sub_ids]), d1,
-                                self._order), d2)
+                                ','.join(['%s' for x in sub_ids]), d1,
+                                self._order),sub_ids + d2)
                     if not cr.rowcount == len({}.fromkeys(sub_ids)):
                         raise except_orm(_('AccessError'),
                                 _('You try to bypass an access rule (Document type: %s).') % self._description)
                 else:
                     cr.execute('SELECT %s FROM \"%s\" WHERE id IN (%s) ORDER BY %s' % \
                             (','.join(fields_pre2 + ['id']), self._table,
-                                ','.join([str(x) for x in sub_ids]),
-                                self._order))
+                                ','.join(['%s' for x in sub_ids]),
+                                self._order), sub_ids)
                 res.extend(cr.dictfetchall())
         else:
             res = map(lambda x: {'id': x}, ids)