[FIX] account, mail, etc.: uniformize evaluated expressions

opw-626694

addons/account/account.py

@@ -31,6 +31,7 @@ from openerp import pooler, tools
 from openerp.osv import fields, osv, expression
 from openerp.tools.translate import _
 from openerp.tools.float_utils import float_round as round
+from openerp.tools.safe_eval import safe_eval as eval
 
 import openerp.addons.decimal_precision as dp
 
@@ -2033,7 +2034,7 @@ class account_tax(osv.osv):
         for tax in taxes:
             if tax.applicable_type=='code':
                 localdict = {'price_unit':price_unit, 'product':product, 'partner':partner}
-                exec tax.python_applicable in localdict
+                eval(tax.python_applicable, localdict, mode="exec", nocopy=True)
                 if localdict.get('result', False):
                     res.append(tax)
             else:
@@ -2074,7 +2075,7 @@ class account_tax(osv.osv):
                # data['amount'] = quantity
             elif tax.type=='code':
                 localdict = {'price_unit':cur_price_unit, 'product':product, 'partner':partner}
-                exec tax.python_compute in localdict
+                eval(tax.python_compute, localdict, mode="exec", nocopy=True)
                 amount = localdict['result']
                 data['amount'] = amount
             elif tax.type=='balance':
@@ -2210,7 +2211,7 @@ class account_tax(osv.osv):
 
             elif tax.type=='code':
                 localdict = {'price_unit':cur_price_unit, 'product':product, 'partner':partner}
-                exec tax.python_compute_inv in localdict
+                eval(tax.python_compute_inv, localdict, mode="exec", nocopy=True)
                 amount = localdict['result']
             elif tax.type=='balance':
                 amount = cur_price_unit - reduce(lambda x,y: y.get('amount',0.0)+x, res, 0.0)

addons/account/wizard/account_invoice_refund.py

@@ -24,6 +24,7 @@ import time
 from openerp.osv import fields, osv
 from openerp.tools.translate import _
 from openerp import netsvc
+from openerp.tools.safe_eval import safe_eval as eval
 
 class account_invoice_refund(osv.osv_memory):
 

addons/account_test/report/account_test_report.py

@@ -24,6 +24,8 @@ import datetime
 import time
 from report import report_sxw
 from openerp.tools.translate import _
+from openerp.tools.safe_eval import safe_eval as eval
+
 #
 # Use period and Journal for selection or resources
 #
@@ -64,7 +66,7 @@ class report_assert_account(report_sxw.rml_parse):
             'result': None, #used to store the result of the test
             'column_order': None, #used to choose the display order of columns (in case you are returning a list of dict)
         }
-        exec code_exec in localdict
+        eval(code_exec, localdict, mode="exec", nocopy=True)
         result = localdict['result']
         column_order = localdict.get('column_order', None)
 

addons/anonymization/anonymization.py

@@ -31,6 +31,7 @@ import random
 import datetime
 from openerp.osv import fields, osv
 from openerp.tools.translate import _
+from openerp.tools.safe_eval import safe_eval as eval
 
 from itertools import groupby
 from operator import itemgetter

addons/base_action_rule/base_action_rule.py

@@ -27,6 +27,7 @@ import openerp
 from openerp import SUPERUSER_ID
 from openerp.osv import fields, osv
 from openerp.tools import DEFAULT_SERVER_DATETIME_FORMAT
+from openerp.tools.safe_eval import safe_eval as eval
 
 _logger = logging.getLogger(__name__)
 

addons/delivery/delivery.py

@@ -23,6 +23,7 @@ import time
 from openerp.osv import fields,osv
 from openerp.tools.translate import _
 import openerp.addons.decimal_precision as dp
+from openerp.tools.safe_eval import safe_eval as eval
 
 class delivery_carrier(osv.osv):
     _name = "delivery.carrier"

addons/l10n_fr/report/base_report.py

@@ -29,6 +29,7 @@
 import time
 
 from openerp.report import report_sxw
+from openerp.tools.safe_eval import safe_eval as eval
 
 class base_report(report_sxw.rml_parse):
     def __init__(self, cr, uid, name, context=None):

addons/mail/mail_alias.py

@@ -27,6 +27,7 @@ from openerp.osv import fields, osv
 from openerp.tools import ustr
 from openerp.modules.registry import RegistryManager
 from openerp import SUPERUSER_ID
+from openerp.tools.safe_eval import safe_eval as eval
 
 _logger = logging.getLogger(__name__)
 

addons/process/process.py

@@ -22,6 +22,7 @@
 from openerp import pooler
 from openerp import tools
 from openerp.osv import fields, osv
+from openerp.tools.safe_eval import safe_eval as eval
 
 class Env(dict):
 

addons/purchase/purchase.py

@@ -33,6 +33,7 @@ import openerp.addons.decimal_precision as dp
 from openerp.osv.orm import browse_record, browse_null
 from openerp.tools import DEFAULT_SERVER_DATE_FORMAT, DEFAULT_SERVER_DATETIME_FORMAT, DATETIME_FORMATS_MAP
 from openerp.tools.float_utils import float_compare
+from openerp.tools.safe_eval import safe_eval as eval
 
 class purchase_order(osv.osv):
 

addons/share/wizard/share_wizard.py

@@ -615,8 +615,8 @@ class share_wizard(osv.TransientModel):
                     # other groups, so we duplicate if needed
                     rule = self._check_personal_rule_or_duplicate(cr, group_id, rule, context=context)
                     eval_ctx = rule_obj._eval_context_for_combinations()
-                    org_domain = expression.normalize_domain(eval(rule.domain_force, eval_ctx))
-                    new_clause = expression.normalize_domain(eval(domain, eval_ctx))
+                    org_domain = expression.normalize_domain(safe_eval(rule.domain_force, eval_ctx))
+                    new_clause = expression.normalize_domain(safe_eval(domain, eval_ctx))
                     combined_domain = expression.AND([new_clause, org_domain])
                     rule.write({'domain_force': combined_domain, 'name': rule.name + _('(Modified)')})
                     _logger.debug("Combining sharing rule %s on model %s with domain: %s", rule.id, model_id, domain)

addons/web_diagram/controllers/main.py

@@ -1,4 +1,5 @@
 import openerp
+from openerp.tools.safe_eval import safe_eval as eval
 
 class DiagramView(openerp.addons.web.http.Controller):
     _cp_path = "/web_diagram/diagram"

openerp/report/report_sxw.py

@@ -36,6 +36,7 @@ import common
 from openerp.osv.fields import float as float_field, function as function_field, datetime as datetime_field
 from openerp.tools.translate import _
 from openerp.tools import DEFAULT_SERVER_DATE_FORMAT, DEFAULT_SERVER_DATETIME_FORMAT
+from openerp.tools.safe_eval import safe_eval as eval
 
 _logger = logging.getLogger(__name__)