[MERGE] Include a security branch to remove the possible sql injections

bzr revid: stephane@openerp.com-20100518094530-y5sdq5ts2vubp7uj

diff --cc addons/account/account.py
index 15e0e30,4e424c5..7d86526
--- 1/addons/account/account.py
--- 2/addons/account/account.py
+++ b/addons/account/account.py
@@@ -211,28 -248,37 +248,37 @@@ class account_account(osv.osv)
              aml_query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
  
              wheres = [""]
 -            if query:
 +            if query.strip():
                  wheres.append(query.strip())
 -            if aml_query:
 +            if aml_query.strip():
                  wheres.append(aml_query.strip())
-             query = " AND ".join(wheres)
- 
-             cr.execute(("SELECT l.account_id as id, " +\
-                     ' , '.join(map(lambda x: mapping[x], field_names)) +
-                     "FROM " \
-                         "account_move_line l " \
-                     "WHERE " \
-                         "l.account_id IN (%s) " \
-                         + query +
-                     " GROUP BY l.account_id") % (acc_set, ))
+             filters = " AND ".join(wheres)
+             self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                       'Filters: %s'%filters)
+             # IN might not work ideally in case there are too many
+             # children_and_consolidated, in that case join on a
+             # values() e.g.:
+             # SELECT l.account_id as id FROM account_move_line l
+             # INNER JOIN (VALUES (id1), (id2), (id3), ...) AS tmp (id)
+             # ON l.account_id = tmp.id
+             # or make _get_children_and_consol return a query and join on that
+             request = ("SELECT l.account_id as id, " +\
+                        ' , '.join(map(mapping.__getitem__, field_names)) +
+                        " FROM account_move_line l" \
+                        " WHERE l.account_id IN %s " \
+                             + filters +
+                        " GROUP BY l.account_id")
+             params = (tuple(children_and_consolidated),) + query_params
+             cr.execute(request, params)
+             self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
+                                       'Status: %s'%cr.statusmessage)
  
              for res in cr.dictfetchall():
                  accounts[res['id']] = res
  
- 
          # consolidate accounts with direct children
 -        brs = list(self.browse(cr, uid, children_and_consolidated,
 -                               context=context))
 +        ids2.reverse()
 +        brs = list(self.browse(cr, uid, ids2, context=context))
          sums = {}
          while brs:
              current = brs[0]
@@@ -919,9 -914,12 +970,12 @@@ class account_move(osv.osv)
                      if new_name:
                          self.write(cr, uid, [move.id], {'name':new_name})
  
-             cr.execute('update account_move set state=%s where id in ('+','.join(map(str,ids))+')', ('posted',))
+             cr.execute('UPDATE account_move '\
+                        'SET state=%s '\
+                        'WHERE id IN %s',
+                        ('posted', tuple(ids)))
          else:
 -            raise osv.except_osv(_('Integrity Error !'), _('You can not validate a non-balanced entry !'))
 +            raise osv.except_osv(_('Integrity Error !'), _('You can not validate a non-balanced entry !\nMake sure you have configured Payment Term properly !\nIt should contain atleast one Payment Term Line with type "Balance" !'))
          return True
  
      def button_validate(self, cursor, user, ids, context=None):
@@@ -1302,23 -1299,7 +1367,16 @@@ class account_tax_code(osv.osv)
          'sign': lambda *args: 1.0,
          'notprintable': lambda *a: False,
      }
-     def _check_recursion(self, cr, uid, ids):
-         level = 100
-         while len(ids):
-             cr.execute('select distinct parent_id from account_tax_code where id in ('+','.join(map(str,ids))+')')
-             ids = filter(None, map(lambda x:x[0], cr.fetchall()))
-             if not level:
-                 return False
-             level -= 1
-         return True
 +    
 +    def copy(self, cr, uid, id, default=None, context=None):
 +        if default is None:
 +            default = {}
 +        default = default.copy()
 +        default.update({'line_ids': []})
 +        return super(account_tax_code, self).copy(cr, uid, id, default, context)
-     
++
+     _check_recursion = check_cycle
++
      _constraints = [
          (_check_recursion, 'Error ! You can not create recursive accounts.', ['parent_id'])
      ]

diff --cc addons/account/account_move_line.py
Simple merge

diff --cc addons/account/invoice.py
index af9f85e,5389947..8af0a68
--- 1/addons/account/invoice.py
--- 2/addons/account/invoice.py
+++ b/addons/account/invoice.py
@@@ -21,9 -21,10 +21,11 @@@
  ##############################################################################
  
  import time
+ from operator import itemgetter
+ 
  import netsvc
  from osv import fields, osv
 +from osv.orm import except_orm
  import pooler
  from tools import config
  from tools.translate import _

diff --cc addons/account_voucher/voucher.py
Simple merge

diff --cc addons/base_module_quality/speed_test/speed_test.py
Simple merge

diff --cc addons/event/event.py
Simple merge

diff --cc addons/hr_timesheet_sheet/hr_timesheet_sheet.py
Simple merge

diff --cc addons/membership/membership.py
Simple merge

diff --cc addons/mrp/mrp.py
Simple merge

diff --cc addons/product/product.py
Simple merge

diff --cc addons/purchase/purchase.py
Simple merge

diff --cc addons/sale/sale.py
index f77a63a,eaea0d6..b6c7e10
--- 1/addons/sale/sale.py
--- 2/addons/sale/sale.py
+++ b/addons/sale/sale.py
@@@ -100,16 -100,13 +100,15 @@@ class sale_order(osv.osv)
                  stock_move m
              LEFT JOIN
                  stock_picking p on (p.id=m.picking_id)
 +            LEFT JOIN
 +                mrp_procurement mp on (mp.move_id=m.id)
              WHERE
-                 p.sale_id in ('''+','.join(map(str, ids))+''')
-             GROUP BY mp.state, p.sale_id''')
-         
-         for oid, nbr, mp_state in cr.fetchall():
-             if mp_state == 'cancel':
+                 p.sale_id in %s
+             GROUP BY m.state, p.sale_id''', (tuple(ids),))
+         for oid, nbr, state in cr.fetchall():
+             if state == 'cancel':
                  continue
 -            if state == 'done':
 +            if mp_state == 'done':
                  res[oid][0] += nbr or 0.0
                  res[oid][1] += nbr or 0.0
              else:

diff --cc addons/scrum/report/_burndown.py
Simple merge

diff --cc addons/stock/stock.py
Simple merge