From fb3638a6f2b5ea01e4ee019debb9a7fb5bbe7774 Mon Sep 17 00:00:00 2001 From: Bertrand Chenal Date: Mon, 28 Jan 2008 23:34:32 +0100 Subject: [PATCH 1/2] Guidelines --- trytond/ir/model.py | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/trytond/ir/model.py b/trytond/ir/model.py index f19fc73b22..1db46f3c9b 100644 --- a/trytond/ir/model.py +++ b/trytond/ir/model.py @@ -210,11 +210,11 @@ class ModelData(OSV): if (fs_id, module) in self.fs2db[cursor.dbname]: return self.fs2db[cursor.dbname][(fs_id, module)][0] else: - raise Exception("Reference to %s not found"% ".".join([module,fs_id])) + raise Exception("Reference to %s not found"%\ + ".".join([module,fs_id])) - - def _clean_value(self, key, browse_record, object_ref): - # XXX self is no use, move this outside the class ? + @staticmethod + def _clean_value(key, browse_record, object_ref): """ Take a field name, a browse_record, and a reference to the corresponding object. Return a raw value has it must look on the @@ -273,7 +273,7 @@ class ModelData(OSV): for key in values: try: - db_field = self._clean_value(key, db_values, object_ref) + db_field = ModelData._clean_value(key, db_values, object_ref) except Unhandled_field: logger = Logger() logger.notify_channel('init', LOG_WARNING, @@ -296,11 +296,13 @@ class ModelData(OSV): (key, db_id, model, fs_id)) continue - elif (old_values[key] and db_field) and old_values[key] != db_field: + elif (old_values[key] and db_field) and \ + old_values[key] != db_field: logger = Logger() logger.notify_channel('init', LOG_WARNING, "Field %s of %s@%s not updated (id: %s), because "\ - "it has changed since the last update."% (key, db_id, model, fs_id)) + "it has changed since the last update."%\ + (key, db_id, model, fs_id)) continue # so, the field in the fs and in the db are different, @@ -316,7 +318,8 @@ class ModelData(OSV): db_val = object_ref.browse(cursor, user, db_id) for key in to_update: try: - values[key] = self._clean_value(key, db_val, object_ref) + values[key] = ModelData._clean_value( + key, db_val, object_ref) except Unhandled_field: continue @@ -341,7 +344,7 @@ class ModelData(OSV): db_val = object_ref.browse(cursor, user, db_id) for key in values: try: - values[key] = self._clean_value(key, db_val, object_ref) + values[key] = ModelData._clean_value(key, db_val, object_ref) except Unhandled_field: continue From 857645cc46bfb9a5e926b5e1994e96fbf312dec6 Mon Sep 17 00:00:00 2001 From: Bertrand Chenal Date: Tue, 29 Jan 2008 00:34:19 +0100 Subject: [PATCH 2/2] Modified some select statement to avoid sql injection --- trytond/osv/orm.py | 54 ++++++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 18 deletions(-) diff --git a/trytond/osv/orm.py b/trytond/osv/orm.py index 9fdcca1b96..ad8a8f65d7 100644 --- a/trytond/osv/orm.py +++ b/trytond/osv/orm.py @@ -1846,6 +1846,9 @@ class ORM(object): tables = ['"' + self._table + '"'] joins = [] while i < len(args): + if args[i][1] not in ('child_of','=','like','ilike','','!=','in'): + raise ExceptORM("Argument '%s' not supported"% args[i][1],"") + table = self if args[i][0] in self._inherit_fields: table = self.pool.get(self._inherit_fields[args[i][0]][0]) @@ -1906,10 +1909,13 @@ class ORM(object): for i in range((len(ids2) / ID_MAX) + \ (len(ids2) % ID_MAX)): sub_ids = ids2[ID_MAX * i:ID_MAX * (i + 1)] - cursor.execute('SELECT "' + field._fields_id + \ - '" FROM "' + field_obj._table + '" ' \ - 'WHERE id IN (' + \ - ','.join([str(x) for x in sub_ids2]) + ')') + cursor.execute( + 'SELECT "' + field._fields_id + \ + '" FROM "' + field_obj._table + '" ' \ + 'WHERE id IN (' + \ + ','.join(['%s' for x in sub_ids2]) + ')', + [str(x) for x in sub_ids2]) + ids3.extend([x[0] for x in cursor.fetchall()]) args[i] = ('id', 'in', ids3) @@ -1936,10 +1942,13 @@ class ORM(object): return ids if not len(ids): return [] - cursor.execute('SELECT "' + field._id1 + '" ' \ - 'FROM "' + field._rel + '" ' \ - 'WHERE "' + field._id2 + '" IN (' + \ - ','.join([str(x) for x in ids]) + ')') + cursor.execute( + 'SELECT "' + field._id1 + '" ' \ + 'FROM "' + field._rel + '" ' \ + 'WHERE "' + field._id2 + '" IN (' + \ + ','.join(['%s' for x in ids]) + ')', + [str(x) for x in ids]) + ids = [x[0] for x in cursor.fetchall()] return ids @@ -1955,10 +1964,13 @@ class ORM(object): if not len(res_ids): args[i] = ('id', 'in', [0]) else: - cursor.execute('SELECT "' + field._id1 + '" ' \ - 'FROM "' + field._rel + '" ' \ - 'WHERE "' + field._id2 + '" IN (' + \ - ','.join([str(x) for x in res_ids]) + ')') + cursor.execute( + 'SELECT "' + field._id1 + '" ' \ + 'FROM "' + field._rel + '" ' \ + 'WHERE "' + field._id2 + '" IN (' + \ + ','.join(['%s' for x in res_ids]) + ')', + [str(x) for x in res_ids]) + args[i] = ('id', 'in', [x[0] for x in cursor.fetchall()]) i += 1 @@ -2007,10 +2019,13 @@ class ORM(object): (table._name + ',' + args[i][0], context.get('language', 'en_US'), 'model', args[i][2])) + ids = [x[0] for x in cursor.fetchall()] - cursor.execute('SELECT id FROM "' + table._table + '" ' \ - 'WHERE "' + args[i][0]+'" '+args[i][1]+' %s', - (args[i][2],)) + cursor.execute( + 'SELECT id FROM "' + table._table + '" ' \ + 'WHERE %s '+args[i][1]+' %s',#FIXME : sql injection here! + (args[i][0], args[i][2],)) + ids += [x[0] for x in cursor.fetchall()] args[i] = ('id', 'in', ids, table) else: @@ -2115,10 +2130,13 @@ class ORM(object): qu1 = ' WHERE ' + ' AND '.join(qu1) else: qu1 = '' - order_by = order or self._order + #XXX should be better if order where smthg like [('name','desc'),('name','asc')]: + order_by = order and order.replace(';','\;') or self._order - limit_str = limit and ' LIMIT %d' % limit or '' - offset_str = offset and ' OFFSET %d' % offset or '' + limit_str = limit and (type(limit) in (float, int, long))\ + and ' LIMIT %d' % limit or '' + offset_str = offset and (type(limit) in (float, int, long))\ + and ' OFFSET %d' % offset or '' # construct a clause for the rules :