NeoAnd/knowledge
1
0
Fork 0
mirror of https://github.com/OCA/knowledge.git synced 2025-07-16 04:02:56 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

[IMP] Call the defined function in cmis module to clean query

Browse Source
This commit is contained in:
EL HADJI DEM 2014-06-12 15:56:52 -04:00 committed by Sandy Carter
parent 997ab32e2d
commit 6957f53ac5
1 changed files with 4 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
cmis_read/wizard/document_wizard.py
View File

@ -117,15 +117,6 @@ class ir_attachment_dms(orm.TransientModel):
}
def sanitize_input_filename_field(file_name):
# Escape the name for characters not supported in filenames
# for avoiding SQL Injection
file_name = file_name.replace("'", "\\'")
file_name = file_name.replace("%", "\%")
file_name = file_name.replace("_", "\_")
return file_name
def search_doc_from_dms(session, model_name, backend_id, file_name, wizard_id):
ir_attach_dms_obj = session.pool.get('ir.attachment.dms')
cmis_backend_obj = session.pool.get('cmis.backend')
@ -139,12 +130,10 @@ def search_doc_from_dms(session, model_name, backend_id, file_name, wizard_id):
attachment_ids = ir_attach_dms_obj.search(session.cr, session.uid, [])
ir_attach_dms_obj.unlink(session.cr, session.uid,
attachment_ids, context=session.context)
# Escape the name for characters not supported in filenames
file_name = sanitize_input_filename_field(file_name)
# Get results from name of document
results = repo.query(" SELECT cmis:name, cmis:createdBy, cmis:objectId, "
"cmis:contentStreamLength FROM cmis:document "
"WHERE cmis:name LIKE '%" + file_name + "%'")
results = cmis_backend_obj.safe_query(
"SELECT cmis:name, cmis:createdBy, cmis:objectId, "
"cmis:contentStreamLength FROM cmis:document "
"WHERE cmis:name LIKE '%%%s%%'", file_name, repo)
for result in results:
info = result.getProperties()
if info['cmis:contentStreamLength'] != 0: