audrius/reporting-engine
1
0
Fork 1
mirror of https://github.com/OCA/reporting-engine.git synced 2025-02-16 16:30:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Avoid possible sql injection in bi_view_editor

Browse Source
This commit is contained in:
Andrea
2017-03-17 13:55:31 +01:00
parent c16e15ed08
commit a04ed55922
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
bi_view_editor/models/ir_model.py
View File

@@ -280,9 +280,8 @@ class IrModel(models.Model):
# this sql update is necessary since a write method here would
# be not working (an orm constraint is restricting the modification
# of the state field while updating ir.model)
q = ("""UPDATE ir_model SET state = 'manual'
WHERE id = """ + str(res.id))
self.env.cr.execute(q)
q = "UPDATE ir_model SET state = 'manual' WHERE id = %s"
self.env.cr.execute(q, (res.id, ))
# # update registry
if self._context.get('bve'):