In __leaf_to_sql: - test left when there is a '.' in the expression - hint: move 'if not leaf...' above the asserts
Test: - try to have a left operand with SQL injection - something like 'create_date from res_partner; --', that should fail if correctly managed, and success if injection possible -- https://code.launchpad.net/~openerp-dev/openobject-server/trunk-join-speedup-tde/+merge/136438 Your team OpenERP R&D Team is subscribed to branch lp:~openerp-dev/openobject-server/trunk-join-speedup-tde. _______________________________________________ Mailing list: https://launchpad.net/~openerp-dev-gtk Post to : [email protected] Unsubscribe : https://launchpad.net/~openerp-dev-gtk More help : https://help.launchpad.net/ListHelp
