From 566999163dffc0ef54acc281bc37e0bcba04bccc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Tue, 14 Apr 2009 19:49:56 +0200 Subject: [PATCH] Fix SQL clause in query_get Security fix for SQL injection in date of context --- move.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/move.py b/move.py index 060c64cdfb..d3caee694b 100644 --- a/move.py +++ b/move.py @@ -9,6 +9,7 @@ from decimal import Decimal import datetime from trytond.netsvc import LocalService import md5 +import mx.DateTime _MOVE_STATES = { 'readonly': "state == 'posted'", @@ -932,6 +933,7 @@ class Line(OSV): context = {} if context.get('date'): + mx.DateTime.strptime(str(context['date']), '%Y-%m-%d') fiscalyear_ids = fiscalyear_obj.search(cursor, user, [ ('start_date', '<=', context['date']), ('end_date', '>=', context['date']), @@ -947,8 +949,8 @@ class Line(OSV): 'WHERE m.period = p.id ' \ 'AND p.fiscalyear = ' + \ str(fiscalyear_ids[0]) + ' ' \ - 'AND m.date <= \'' + \ - str(context['date']) + '\' ' \ + 'AND m.date <= date(\'' + \ + str(context['date']) + '\') ' \ 'AND m.state = \'posted\' ' \ ')', fiscalyear_ids) else: @@ -960,8 +962,8 @@ class Line(OSV): 'WHERE m.period = p.id ' \ 'AND p.fiscalyear = ' + \ str(fiscalyear_ids[0]) + ' ' \ - 'AND m.date <= \'' + \ - str(context['date']) + '\'' \ + 'AND m.date <= date(\'' + \ + str(context['date']) + '\')' \ ')', fiscalyear_ids) if not context.get('fiscalyear', False):