odoo
/
odoo
2
0
Fork 0
Code Pull Requests Releases Activity

[FIX] Security Loophole corrected 

lp bug: https://launchpad.net/bugs/422563 fixed

bzr revid: jvo@tinyerp.com-20090901150136-tjpngpcfixg940b6
This commit is contained in:
Cédric Krier 2009-09-01 20:31:36 +05:30 committed by Jay (Open ERP)
parent 19685f3ab3
commit 40666e1316
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bin/osv/orm.py
View File

@ -2122,16 +2122,16 @@ class orm(orm_template):
if d1:
cr.execute('SELECT %s FROM \"%s\" WHERE id IN (%s) AND %s ORDER BY %s' % \
(','.join(fields_pre2 + ['id']), self._table,
','.join([str(x) for x in sub_ids]), d1,
self._order), d2)
','.join(['%s' for x in sub_ids]), d1,
self._order),sub_ids + d2)
if not cr.rowcount == len({}.fromkeys(sub_ids)):
raise except_orm(_('AccessError'),
_('You try to bypass an access rule (Document type: %s).') % self._description)
else:
cr.execute('SELECT %s FROM \"%s\" WHERE id IN (%s) ORDER BY %s' % \
(','.join(fields_pre2 + ['id']), self._table,
','.join([str(x) for x in sub_ids]),
self._order))
','.join(['%s' for x in sub_ids]),
self._order), sub_ids)
res.extend(cr.dictfetchall())
else:
res = map(lambda x: {'id': x}, ids)