From 9cabb70c14bf195ed5f827672ffbbf4645b97ca4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Sat, 22 Mar 2008 19:33:55 +0100
Subject: [PATCH] Security fix: use %s in sql query and improve order

---
 account.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/account.py b/account.py
index 021369e6d4..d0cd974a18 100644
--- a/account.py
+++ b/account.py
@@ -31,7 +31,7 @@ class Account(OSV):
     'Account'
     _name = 'account.account'
     _description = __doc__
-    _order = 'code'
+    _order = 'code, id'
     _parent_name = 'parents'
 
     name = fields.Char('Name', size=None, required=True, translate=True,
@@ -153,10 +153,10 @@ class Account(OSV):
                     'ON (a.id = l.account) ' \
                 'WHERE a.type != \'view\' ' \
                     'AND a.id IN (' + \
-                        ','.join([str(x) for x in all_ids]) + ') ' \
+                        ','.join(['%s' for x in all_ids]) + ') ' \
                     'AND ' + line_query + ' ' \
                     'AND a.active ' \
-                'GROUP BY a.id')
+                'GROUP BY a.id', all_ids)
         account_sum = {}
         for account_id, sum in cursor.fetchall():
             account_sum[account_id] = sum
@@ -202,10 +202,10 @@ class Account(OSV):
                     'ON (a.id = l.account) ' \
                 'WHERE a.type != \'view\' ' \
                     'AND a.id IN (' + \
-                        ','.join([str(x) for x in ids]) + ') ' \
+                        ','.join(['%s' for x in ids]) + ') ' \
                     'AND ' + line_query + ' ' \
                     'AND a.active ' \
-                'GROUP BY a.id')
+                'GROUP BY a.id', ids)
         for account_id, sum in cursor.fetchall():
             res[account_id] = sum