[REF]odoorecord: fix sql-injection error.

Zakaria Makrelouf · Zakaria Makrelouf · commit 53f62d1dc2cf · 2018-12-24T15:52:58.000+04:00
diff --git a/connector_importer/components/odoorecord.py b/connector_importer/components/odoorecord.py
@@ -109,7 +109,7 @@ def odoo_write(self, values, orig_values):
 
     def _force_value(self, record, values, fname):
         self.env.cr.execute(
-            'UPDATE {} SET {} = %s WHERE id = %s'.format(record._table, fname),
-            (values[fname], record.id, )
+            'UPDATE %s SET %s = %s WHERE id = %s',
+            (record._table, fname, values[fname], record.id, )
         )
         record.invalidate_cache([fname, ])

Original file line number	Diff line number	Diff line change
`@@ -109,7 +109,7 @@ def odoo_write(self, values, orig_values):`
`109`	`109`
`110`	`110`	`def _force_value(self, record, values, fname):`
`111`	`111`	`self.env.cr.execute(`
`112`		`- 'UPDATE {} SET {} = %s WHERE id = %s'.format(record._table, fname),`
`113`		`- (values[fname], record.id, )`
	`112`	`+ 'UPDATE %s SET %s = %s WHERE id = %s',`
	`113`	`+ (record._table, fname, values[fname], record.id, )`
`114`	`114`	`)`
`115`	`115`	`record.invalidate_cache([fname, ])`