Merge lp:~fabien-morin/unifield-server/fm-us-3386 into lp:unifield-server

[jftempo]

[jftempo (jfb-tempo-consulting)]

to fix

[Fabien MORIN (fabien-morin)]

On vendredi 6 octobre 2017 09:15:36 CEST you wrote:
> to fix
>
> Diff comments:
>
> > === modified file 'bin/addons/account/account.py'
> > --- bin/addons/account/account.py 2017-09-18 12:35:40 +0000
> > +++ bin/addons/account/account.py 2017-10-05 14:03:24 +0000
> > @@ -1189,13 +1080,18 @@
> > if isinstance(cond[2],(list,tuple)):
> > if cond[1] in ['in','not in']:
> > amount = tuple(cond[2])
> > + for cur_amount in amount:
> > + if not isinstance(cur_amount, (int, long, float)):
> > + raise osv.except_osv(_('Error'), _('The amount have to be a number'))
> > else:
> > continue
> > else:
> > + if not isinstance(amount, (int, long, float)):
> > + raise osv.except_osv(_('Error'), _('The amount have to be a number'))
>
> amount is already protected and not string concatenated in cr.execute
> Do we need this check ?

I did some tries and I was not able to pass other things than number to this method, so, you right, it is well enough protected already, I will remove this extra protection.
Sometimes there is no need to have string concatenated in a cr.execute to get an sql injection flaw, I can show you how in some curently in use forms it is possible to filter by an sql injection that will reset the admin password (or drop table, ...)
But in this precise case, the risk is already filter by the web. (I was thinking it was possible to squeeze the web check by changing the html with an inspector, but I was not able to).

>
> > if cond[1] in ['=like', 'like', 'not like', 'ilike', 'not ilike', 'in', 'not in', 'child_of']:
> > continue
> >
> > - cr.execute("select move_id from account_move_line group by move_id having sum(debit) %s %%s" % (cond[1]),(amount,))
> > + cr.execute("select move_id from account_move_line group by move_id having sum(debit) %s %%s" % (cond[1]),(amount,)) # ignore_sql_check
> > res_ids = set(id[0] for id in cr.fetchall())
> > ids = ids and (ids & res_ids) or res_ids
> > if ids:
> > @@ -1704,25 +1600,27 @@
> > def _sum(self, cr, uid, ids, name, args, context, where ='', where_params=()):
> > parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
> > if context.get('based_on', 'invoices') == 'payments':
> > - cr.execute('SELECT line.tax_code_id, sum(line.tax_amount) \
> > - FROM account_move_line AS line, \
> > - account_move AS move \
> > - LEFT JOIN account_invoice invoice ON \
> > - (invoice.move_id = move.id) \
> > - WHERE line.tax_code_id IN %s '+where+' \
> > - AND move.id = line.move_id \
> > - AND ((invoice.state = \'paid\') \
> > - OR (invoice.id IS NULL)) \
> > - GROUP BY line.tax_code_id',
> > - (parent_ids,) + where_params)
> > + ...

=== modified file 'bin/addons/account/account.py'
--- bin/addons/account/account.py	2017-09-18 12:35:40 +0000
+++ bin/addons/account/account.py	2017-10-06 09:59:17 +0000
@@ -39,10 +39,11 @@
     """
     level = 100
     while len(ids):
-        cr.execute('SELECT DISTINCT parent_id '\
-                   'FROM '+self._table+' '\
-                   'WHERE id IN %s '\
-                   'AND parent_id IS NOT NULL',(tuple(ids),))
+        cr.execute('''
+            SELECT DISTINCT parent_id
+            FROM %s
+            WHERE id IN %%s
+            AND parent_id IS NOT NULL''' % self._table, (tuple(ids),))  # not_a_user_entry
         ids = map(itemgetter(0), cr.fetchall())
         if not level:
             return False
@@ -242,101 +243,6 @@
             ids3 = self._get_children_and_consol(cr, uid, ids3, context=context)
         return ids2 + ids3
 
-
-    def __compute(self, cr, uid, ids, field_names, arg=None, context=None,
-                  query='', query_params=()):
-        """ compute the balance, debit and/or credit for the provided
-        account ids
-        Arguments:
-        `ids`: account ids
-        `field_names`: the fields to compute (a list of any of
-                       'balance', 'debit' and 'credit')
-        `arg`: unused fields.function stuff
-        `query`: additional query filter (as a string)
-        `query_params`: parameters for the provided query string
-                        (__compute will handle their escaping) as a
-                        tuple
-        """
-        if context is None:
-            context = {}
-        mapping = {
-            'balance': "COALESCE(SUM(l.debit),0) " \
-                       "- COALESCE(SUM(l.credit), 0) as balance",
-            'debit': "COALESCE(SUM(l.debit), 0) as debit",
-            'credit': "COALESCE(SUM(l.credit), 0) as credit"
-        }
-        #get all the necessary accounts
-        children_and_consolidated = self._get_children_and_consol(cr, uid, ids,
-                                                                  context=context)
-        #compute for each account the balance/debit/credit from the move lines
-        accounts = {}
-        sums = {}
-        if children_and_consolidated:
-            aml_query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
-
-            wheres = [""]
-            if query.strip():
-                wheres.append(query.strip())
-            if aml_query.strip():
-                wheres.append(aml_query.strip())
-            filters = " AND ".join(wheres)
-            self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
-                                      'Filters: %s'%filters)
-            # IN might not work ideally in case there are too many
-            # children_and_consolidated, in that case join on a
-            # values() e.g.:
-            # SELECT l.account_id as id FROM account_move_line l
-            # INNER JOIN (VALUES (id1), (id2), (id3), ...) AS tmp (id)
-            # ON l.account_id = tmp.id
-            # or make _get_children_and_consol return a query and join on that
-            request = ("SELECT l.account_id as id, " +\
-                       ', '.join(map(mapping.__getitem__, field_names)) +
-                       " FROM account_move_line l" \
-                       " WHERE l.account_id IN %s " \
-                       + filters +
-                       " GROUP BY l.account_id")
-            params = (tuple(children_and_consolidated),) + query_params
-            cr.execute(request, params)
-            self.logger.notifyChannel('addons.'+self._name, netsvc.LOG_DEBUG,
-                                      'Status: %s'%cr.statusmessage)
-
-            for res in cr.dictfetchall():
-                accounts[res['id']] = res
-
-            # consolidate accounts with direct children
-            children_and_consolidated.reverse()
-            brs = list(self.browse(cr, uid, children_and_consolidated, context=context))
-            currency_obj = self.pool.get('res.currency')
-            display_only_checked_account = context.get('display_only_checked_account', False)
-            while brs:
-                current = brs[0]
-#                can_compute = True
-#                for child in current.child_id:
-#                    if child.id not in sums:
-#                        can_compute = False
-#                        try:
-#                            brs.insert(0, brs.pop(brs.index(child)))
-#                        except ValueError:
-#                            brs.insert(0, child)
-#                if can_compute:
-                brs.pop(0)
-                for fn in field_names:
-                    sums.setdefault(current.id, {})[fn] = accounts.get(current.id, {}).get(fn, 0.0)
-                    for child in current.child_id:
-                        # in context of report, if the current account is not
-                        # displayed, it should no impact the total amount
-                        if display_only_checked_account and not child.display_in_reports:
-                            continue
-                        if child.company_id.currency_id.id == current.company_id.currency_id.id:
-                            sums[current.id][fn] += sums[child.id][fn]
-                        else:
-                            sums[current.id][fn] += currency_obj.compute(cr, uid, child.company_id.currency_id.id, current.company_id.currency_id.id, sums[child.id][fn], context=context)
-        res = {}
-        null_result = dict((fn, 0.0) for fn in field_names)
-        for id in ids:
-            res[id] = sums.get(id, null_result)
-        return res
-
     def _get_company_currency(self, cr, uid, ids, field_name, arg, context=None):
         result = {}
         for rec in self.browse(cr, uid, ids, context=context):
@@ -409,9 +315,6 @@
         'child_parent_ids': fields.one2many('account.account','parent_id','Children'),
         'child_consol_ids': fields.many2many('account.account', 'account_account_consol_rel', 'child_id', 'parent_id', 'Consolidated Children'),
         'child_id': fields.function(_get_child_ids, method=True, type='many2many', relation="account.account", string="Child Accounts"),
-        'balance': fields.function(__compute, digits_compute=dp.get_precision('Account'), method=True, string='Balance', multi='balance'),
-        'credit': fields.function(__compute, digits_compute=dp.get_precision('Account'), method=True, string='Credit', multi='balance'),
-        'debit': fields.function(__compute, digits_compute=dp.get_precision('Account'), method=True, string='Debit', multi='balance'),
         'reconcile': fields.boolean('Reconcile', help="Check this if the user is allowed to reconcile entries in this account."),
         'shortcut': fields.char('Shortcut', size=12),
         'tax_ids': fields.many2many('account.tax', 'account_account_tax_default_rel',
@@ -510,18 +413,6 @@
             ids = self.search(cr, user, args, context=context, limit=limit)
         return self.name_get(cr, user, ids, context=context)
 
-    def name_get(self, cr, uid, ids, context=None):
-        if not ids:
-            return []
-        reads = self.read(cr, uid, ids, ['name', 'code'], context=context)
-        res = []
-        for record in reads:
-            name = record['name']
-            if record['code']:
-                name = record['code'] + ' '+name
-            res.append((record['id'], name))
-        return res
-
     def copy(self, cr, uid, id, default={}, context=None, done_list=[], local=False):
         account = self.browse(cr, uid, id, context=context)
         new_child_ids = []
@@ -1195,7 +1086,7 @@
                 if cond[1] in ['=like', 'like', 'not like', 'ilike', 'not ilike', 'in', 'not in', 'child_of']:
                     continue
 
-            cr.execute("select move_id from account_move_line group by move_id having sum(debit) %s %%s" % (cond[1]),(amount,))
+            cr.execute("select move_id from account_move_line group by move_id having sum(debit) %s %%s" % (cond[1]),(amount,))  # ignore_sql_check
             res_ids = set(id[0] for id in cr.fetchall())
             ids = ids and (ids & res_ids) or res_ids
         if ids:
@@ -1455,9 +1346,9 @@
         else:
             line_id2 = 0
 
-        cr.execute('SELECT SUM(%s) FROM account_move_line WHERE move_id=%%s AND id!=%%s' % (mode,), (move.id, line_id2))
+        cr.execute('SELECT SUM(%s) FROM account_move_line WHERE move_id=%%s AND id!=%%s' % (mode,), (move.id, line_id2))  # not_a_user_entry
         result = cr.fetchone()[0] or 0.0
-        cr.execute('update account_move_line set '+mode2+'=%s where id=%s', (result, line_id))
+        cr.execute('update account_move_line set '+mode2+'=%s where id=%s', (result, line_id))  # not_a_user_entry
 
         #adjust also the amount in currency if needed
         cr.execute("select currency_id, sum(amount_currency) as amount_currency from account_move_line where move_id = %s and currency_id is not null group by currency_id", (move.id,))
@@ -1704,25 +1595,27 @@
     def _sum(self, cr, uid, ids, name, args, context, where ='', where_params=()):
         parent_ids = tuple(self.search(cr, uid, [('parent_id', 'child_of', ids)]))
         if context.get('based_on', 'invoices') == 'payments':
-            cr.execute('SELECT line.tax_code_id, sum(line.tax_amount) \
-                    FROM account_move_line AS line, \
-                        account_move AS move \
-                        LEFT JOIN account_invoice invoice ON \
-                            (invoice.move_id = move.id) \
-                    WHERE line.tax_code_id IN %s '+where+' \
-                        AND move.id = line.move_id \
-                        AND ((invoice.state = \'paid\') \
-                            OR (invoice.id IS NULL)) \
-                            GROUP BY line.tax_code_id',
-                       (parent_ids,) + where_params)
+            cr.execute('''
+                SELECT line.tax_code_id, sum(line.tax_amount)
+                FROM account_move_line AS line,
+                     account_move AS move
+                     LEFT JOIN account_invoice invoice ON
+                        (invoice.move_id = move.id)
+                WHERE line.tax_code_id IN %%s %s
+                    AND move.id = line.move_id
+                    AND ((invoice.state = 'paid')
+                        OR (invoice.id IS NULL))
+                GROUP BY line.tax_code_id''' % where,  # not_a_user_entry
+                (parent_ids,) + where_params)
         else:
-            cr.execute('SELECT line.tax_code_id, sum(line.tax_amount) \
-                    FROM account_move_line AS line, \
-                    account_move AS move \
-                    WHERE line.tax_code_id IN %s '+where+' \
-                    AND move.id = line.move_id \
-                    GROUP BY line.tax_code_id',
-                       (parent_ids,) + where_params)
+            cr.execute('''
+                SELECT line.tax_code_id, sum(line.tax_amount)
+                FROM account_move_line AS line,
+                account_move AS move
+                WHERE line.tax_code_id IN %%s %s
+                AND move.id = line.move_id
+                GROUP BY line.tax_code_id''' % where,  # not_a_user_entry
+                (parent_ids,) + where_params)
         res = dict(cr.fetchall())
         res2 = {}
         obj_precision = self.pool.get('decimal.precision')

=== modified file 'bin/addons/account/account_move_line.py'
--- bin/addons/account/account_move_line.py	2017-07-19 13:23:04 +0000
+++ bin/addons/account/account_move_line.py	2017-10-06 09:59:17 +0000
@@ -415,9 +415,7 @@
                     FROM account_move_line l1, account_move_line l2
                     WHERE l2.account_id = l1.account_id
                       AND l1.id <= l2.id
-                      AND l2.id IN %s AND """ + \
-            self._query_get(cr, uid, obj='l1', context=c) + \
-            " GROUP BY l2.id"
+                      AND l2.id IN %%s AND %s GROUP BY l2.id""" % self._query_get(cr, uid, obj='l1', context=c)  # ignore_sql_check
 
         cr.execute(sql, [tuple(ids)])
         result = dict(cr.fetchall())
@@ -465,7 +463,7 @@
             return []
         where = ' AND '.join(map(lambda x: '(abs(sum(debit-credit))'+x[1]+str(x[2])+')',args))
         cursor.execute('SELECT id, SUM(debit-credit) FROM account_move_line \
-                     GROUP BY id, debit, credit having '+where)
+                        GROUP BY id, debit, credit having '+where)  # not_a_user_entry
         res = cursor.fetchall()
         if not res:
             return [('id', '=', '0')]
@@ -508,9 +506,10 @@
             qu1 = ' AND' + ' AND'.join(qu1)
         else:
             qu1 = ''
-        cursor.execute('SELECT l.id ' \
-                       'FROM account_move_line l, account_invoice i ' \
-                       'WHERE l.move_id = i.move_id ' + qu1, qu2)
+        cursor.execute('''
+            SELECT l.id
+            FROM account_move_line l, account_invoice i
+            WHERE l.move_id = i.move_id ''' + qu1, qu2)  # not_a_user_entry
         res = cursor.fetchall()
         if not res:
             return [('id', '=', '0')]

=== modified file 'bin/addons/account/partner.py'
--- bin/addons/account/partner.py	2011-01-14 00:11:01 +0000
+++ bin/addons/account/partner.py	2017-10-06 09:59:17 +0000
@@ -93,16 +93,16 @@
 
     def _credit_debit_get(self, cr, uid, ids, field_names, arg, context=None):
         query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
-        cr.execute("""SELECT l.partner_id, a.type, SUM(l.debit-l.credit)
-                      FROM account_move_line l
-                      LEFT JOIN account_account a ON (l.account_id=a.id)
-                      WHERE a.type IN ('receivable','payable')
-                      AND l.partner_id IN %s
-                      AND l.reconcile_id IS NULL
-                      AND """ + query + """
-                      GROUP BY l.partner_id, a.type
-                      """,
-                   (tuple(ids),))
+        cr.execute("""
+            SELECT l.partner_id, a.type, SUM(l.debit-l.credit)
+            FROM account_move_line l
+            LEFT JOIN account_account a ON (l.account_id=a.id)
+            WHERE a.type IN ('receivable','payable')
+            AND l.partner_id IN %%s
+            AND l.reconcile_id IS NULL
+            AND %s
+            GROUP BY l.partner_id, a.type""" % query,  # not_a_user_entry
+            (tuple(ids),))
         maps = {'receivable':'credit', 'payable':'debit' }
         res = {}
         for id in ids:
@@ -112,7 +112,7 @@
             res[pid][maps[type]] = (type=='receivable') and val or -val
         return res
 
-    def _asset_difference_search(self, cr, uid, obj, name, type, args, context=None):
+    def _asset_difference_search(self, cr, uid, obj, name, line_type, args, context=None):
         if not args:
             return []
         having_values = tuple(map(itemgetter(2), args))
@@ -120,15 +120,16 @@
             map(lambda x: '(SUM(debit-credit) %(operator)s %%s)' % {
                                 'operator':x[1]},args))
         query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
-        cr.execute(('SELECT partner_id FROM account_move_line l '\
-                    'WHERE account_id IN '\
-                        '(SELECT id FROM account_account '\
-                        'WHERE type=%s AND active) '\
-                    'AND reconcile_id IS NULL '\
-                    'AND '+query+' '\
-                    'AND partner_id IS NOT NULL '\
-                    'GROUP BY partner_id HAVING '+where),
-                   (type,) + having_values)
+        cr.execute(('''
+            SELECT partner_id FROM account_move_line l
+            WHERE account_id IN
+               (SELECT id FROM account_account
+               WHERE type=%%s AND active)
+            AND reconcile_id IS NULL
+            AND %s
+            AND partner_id IS NOT NULL
+            GROUP BY partner_id HAVING %s''' % (query, where)),  # not_a_user_entry
+                   (line_type,) + having_values)
         res = cr.fetchall()
         if not res:
             return [('id','=','0')]

=== modified file 'bin/addons/account/res_currency.py'
--- bin/addons/account/res_currency.py	2011-01-14 00:11:01 +0000
+++ bin/addons/account/res_currency.py	2017-10-06 09:59:17 +0000
@@ -33,8 +33,8 @@
         account_invert = context.get('res.currency.compute.account_invert')
         if account and account.currency_mode == 'average' and account.currency_id:
             query = self.pool.get('account.move.line')._query_get(cr, uid, context=context)
-            cr.execute('select sum(debit-credit),sum(amount_currency) from account_move_line l ' \
-              'where l.currency_id=%s and l.account_id=%s and '+query, (account.currency_id.id,account.id,))
+            cr.execute('''select sum(debit-credit),sum(amount_currency) from account_move_line l
+                where l.currency_id=%%s and l.account_id=%%s and %s''' % query, (account.currency_id.id,account.id,))  # not_a_user_entry
             tot1,tot2 = cr.fetchone()
             if tot2 and not account_invert:
                 rate = float(tot1)/float(tot2)
@@ -44,4 +44,4 @@
 
 res_currency_account()
 
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
\ No newline at end of file
+# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'bin/addons/account/sequence.py'
--- bin/addons/account/sequence.py	2013-11-25 16:23:07 +0000
+++ bin/addons/account/sequence.py	2017-10-06 09:59:17 +0000
@@ -49,8 +49,8 @@
     def get_id(self, cr, uid, sequence_id, code_or_id='id', context=None):
         if context is None:
             context = {}
-        cr.execute('select id from ir_sequence where '
-                   + code_or_id + '=%s and active=%s', (sequence_id, True,))
+        cr.execute('''select id from ir_sequence
+            where %s=%%s and active=%%s''' % code_or_id, (sequence_id, True,))  # not_a_user_entry
         res = cr.dictfetchone()
         if res:
             for line in self.browse(cr, uid, res['id'],

=== modified file 'bin/addons/account/wizard/account_automatic_reconcile.py'
--- bin/addons/account/wizard/account_automatic_reconcile.py	2011-01-14 00:11:01 +0000
+++ bin/addons/account/wizard/account_automatic_reconcile.py	2017-10-06 09:59:17 +0000
@@ -228,12 +228,12 @@
             # add the number of transactions for partners who have only one
             # unreconciled transactions to the unreconciled count
             partner_filter = partner_ids and 'AND partner_id not in (%s)' % ','.join(map(str, filter(None, partner_ids))) or ''
-            cr.execute(
-                "SELECT count(*) " \
-                "FROM account_move_line " \
-                "WHERE account_id=%s " \
-                "AND reconcile_id IS NULL " \
-                "AND state <> 'draft' " + partner_filter,
+            cr.execute("""
+                SELECT count(*)
+                FROM account_move_line
+                WHERE account_id=%s
+                AND reconcile_id IS NULL
+                AND state <> 'draft' """ + partner_filter,  # not_a_user_entry
                 (account_id,))
             additional_unrec = cr.fetchone()[0]
             unreconciled = unreconciled + additional_unrec
@@ -252,4 +252,4 @@
 
 account_automatic_reconcile()
 
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
\ No newline at end of file
+# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'bin/addons/account/wizard/account_fiscalyear_close.py'
--- bin/addons/account/wizard/account_fiscalyear_close.py	2011-06-22 20:05:58 +0000
+++ bin/addons/account/wizard/account_fiscalyear_close.py	2017-10-06 09:59:17 +0000
@@ -63,9 +63,9 @@
         fy_id = data[0]['fy_id']
 
         cr.execute("SELECT id FROM account_period WHERE date_stop < (SELECT date_start FROM account_fiscalyear WHERE id = %s)", (str(data[0]['fy2_id']),))
-        fy_period_set = ','.join(map(lambda id: str(id[0]), cr.fetchall()))
+        fy_period_list = [x[0] for x in cr.fetchall()]
         cr.execute("SELECT id FROM account_period WHERE date_start > (SELECT date_stop FROM account_fiscalyear WHERE id = %s)", (str(fy_id),))
-        fy2_period_set = ','.join(map(lambda id: str(id[0]), cr.fetchall()))
+        fy2_period_list = [x[0] for x in cr.fetchall()]
 
         period = obj_acc_period.browse(cr, uid, data[0]['period_id'], context=context)
         new_fyear = obj_acc_fiscalyear.browse(cr, uid, data[0]['fy2_id'], context=context)
@@ -103,15 +103,16 @@
             if accnt_type_data.close_method=='none' or account.type == 'view':
                 continue
             if accnt_type_data.close_method=='balance':
-                
+
                 balance_in_currency = 0.0
                 if account.currency_id:
-                    cr.execute('SELECT sum(amount_currency) as balance_in_currency FROM account_move_line ' \
-                            'WHERE account_id = %s ' \
-                                'AND ' + query_line + ' ' \
-                                'AND currency_id = %s', (account.id, account.currency_id.id)) 
+                    cr.execute('''
+                            SELECT sum(amount_currency) as balance_in_currency FROM account_move_line
+                            WHERE account_id = %%s
+                                AND %s
+                                AND currency_id = %%s''' % query_line, (account.id, account.currency_id.id))  # not_a_user_entry
                     balance_in_currency = cr.dictfetchone()['balance_in_currency']
-                    
+
                 if abs(account.balance)>0.0001:
                     obj_acc_move_line.create(cr, uid, {
                         'debit': account.balance>0 and account.balance,
@@ -128,15 +129,16 @@
                 offset = 0
                 limit = 100
                 while True:
-                    cr.execute('SELECT id, name, quantity, debit, credit, account_id, ref, ' \
-                                'amount_currency, currency_id, blocked, partner_id, ' \
-                                'date_maturity, date_created ' \
-                            'FROM account_move_line ' \
-                            'WHERE account_id = %s ' \
-                                'AND ' + query_line + ' ' \
-                                'AND reconcile_id is NULL ' \
-                            'ORDER BY id ' \
-                            'LIMIT %s OFFSET %s', (account.id, limit, offset))
+                    cr.execute('''
+                            SELECT id, name, quantity, debit, credit, account_id, ref,
+                                amount_currency, currency_id, blocked, partner_id,
+                                date_maturity, date_created
+                            FROM account_move_line
+                            WHERE account_id = %%s
+                                AND %s
+                                AND reconcile_id is NULL
+                            ORDER BY id
+                            LIMIT %%s OFFSET %%s''' % query_line, (account.id, limit, offset))  # not_a_user_entry
                     result = cr.dictfetchall()
                     if not result:
                         break
@@ -158,17 +160,18 @@
                 offset = 0
                 limit = 100
                 while True:
-                    cr.execute('SELECT  DISTINCT b.id, b.name, b.quantity, b.debit, b.credit, b.account_id, b.ref, ' \
-                                'b.amount_currency, b.currency_id, b.blocked, b.partner_id, ' \
-                                'b.date_maturity, b.date_created ' \
-                            'FROM account_move_line a, account_move_line b ' \
-                            'WHERE b.account_id = %s ' \
-                                'AND b.reconcile_id is NOT NULL ' \
-                                'AND a.reconcile_id = b.reconcile_id ' \
-                                'AND b.period_id IN ('+fy_period_set+') ' \
-                                'AND a.period_id IN ('+fy2_period_set+') ' \
-                            'ORDER BY id ' \
-                            'LIMIT %s OFFSET %s', (account.id, limit, offset))
+                    cr.execute('''
+                            SELECT  DISTINCT b.id, b.name, b.quantity, b.debit, b.credit, b.account_id, b.ref,
+                                b.amount_currency, b.currency_id, b.blocked, b.partner_id,
+                                b.date_maturity, b.date_created
+                            FROM account_move_line a, account_move_line b
+                            WHERE b.account_id = %s
+                                AND b.reconcile_id is NOT NULL
+                                AND a.reconcile_id = b.reconcile_id
+                                AND b.period_id IN %s
+                                AND a.period_id IN %s
+                            ORDER BY id
+                            LIMIT %s OFFSET %s''', (account.id, fy_period_list, fy2_period_list, limit, offset))
                     result = cr.dictfetchall()
                     if not result:
                         break
@@ -188,14 +191,15 @@
                 offset = 0
                 limit = 100
                 while True:
-                    cr.execute('SELECT id, name, quantity, debit, credit, account_id, ref, ' \
-                                'amount_currency, currency_id, blocked, partner_id, ' \
-                                'date_maturity, date_created ' \
-                            'FROM account_move_line ' \
-                            'WHERE account_id = %s ' \
-                                'AND ' + query_line + ' ' \
-                            'ORDER BY id ' \
-                            'LIMIT %s OFFSET %s', (account.id, limit, offset))
+                    cr.execute('''
+                            SELECT id, name, quantity, debit, credit, account_id, ref,
+                                amount_currency, currency_id, blocked, partner_id,
+                                date_maturity, date_created
+                            FROM account_move_line
+                            WHERE account_id = %%s
+                                AND %s
+                            ORDER BY id
+                            LIMIT %%s OFFSET %%s''' % query_line, (account.id, limit, offset))  # not_a_user_entry
 
                     result = cr.dictfetchall()
                     if not result:

=== modified file 'bin/addons/account_corrections/wizard/analytic_distribution_wizard.py'
--- bin/addons/account_corrections/wizard/analytic_distribution_wizard.py	2017-09-08 13:56:55 +0000
+++ bin/addons/account_corrections/wizard/analytic_distribution_wizard.py	2017-10-06 09:59:17 +0000
@@ -348,7 +348,7 @@
                     sql_to_cor += ['entry_sequence=%s', 'last_corrected_id=%s', 'ref=%s']
                     sql_data += [keep_seq_and_corrected[0], keep_seq_and_corrected[1], keep_seq_and_corrected[3] or '']
                 sql_data += [created_analytic_line_ids[new_distrib_line]]
-                cr.execute('update account_analytic_line set '+','.join(sql_to_cor)+' where id = %s',
+                cr.execute('update account_analytic_line set '+','.join(sql_to_cor)+' where id = %s',  # not_a_user_entry
                            sql_data)
             have_been_created.append(created_analytic_line_ids[new_distrib_line])
             if created_analytic_line_ids and greater_amount['gap_amount'] and greater_amount['wl'] and greater_amount['wl'].id == line.id:

=== modified file 'bin/addons/account_hq_entries/wizard/hq_entries_validation.py'
--- bin/addons/account_hq_entries/wizard/hq_entries_validation.py	2016-11-16 17:25:09 +0000
+++ bin/addons/account_hq_entries/wizard/hq_entries_validation.py	2017-10-06 09:59:17 +0000
@@ -349,7 +349,7 @@
                 ana_line_obj.write(cr, uid, aal.id, {'last_corrected_id': original_aal_ids[0],'name': cor_name, 'ref': cor_ref})
             # also write the OD entry_sequence to the REV aal
             # ana_line_obj.write(cr, uid, res_reverse, {'journal_id': acor_journal_id, 'entry_sequence': aal.entry_sequence})
-            cr.execute('''update account_analytic_line set entry_sequence = '%s' where id = %s''' % (aal.entry_sequence, res_reverse[0]))
+            cr.execute('''UPDATE account_analytic_line SET entry_sequence=%s WHERE id=%s''', (aal.entry_sequence, res_reverse[0]))
 
         # US-1333/1 - BKLG-12 pure AD correction flag marker for splitted lines
         # (do this bypassing model write)

=== modified file 'bin/addons/account_override/account.py'
--- bin/addons/account_override/account.py	2017-08-18 13:59:37 +0000
+++ bin/addons/account_override/account.py	2017-10-06 09:59:17 +0000
@@ -76,7 +76,6 @@
                 arg.append(('inactivation_date', '<=', cmp_date))
         return arg
 
-    #@@@override account.account_account.__compute
     def __compute(self, cr, uid, ids, field_names, arg=None, context=None,
                   query='', query_params=()):
         """ compute the balance, debit and/or credit for the provided
@@ -136,7 +135,8 @@
             # target_move from chart of account wizard
             filters = filters.replace("AND l.state <> 'draft'", '')
             prefilters = " "
-            if context.get('move_state', False):
+            possible_states = [x[0] for x in self.pool.get('account.move')._columns['state'].selection]
+            if context.get('move_state', False) and context['move_state'] in possible_states:
                 prefilters += "AND l.move_id = m.id AND m.state = '%s'" % context.get('move_state')
             else:
                 prefilters += "AND l.move_id = m.id AND m.state in ('posted', 'draft')"
@@ -150,12 +150,10 @@
             # INNER JOIN (VALUES (id1), (id2), (id3), ...) AS tmp (id)
             # ON l.account_id = tmp.id
             # or make _get_children_and_consol return a query and join on that
-            request = ("SELECT l.account_id as id, " +\
-                       ', '.join(map(mapping.__getitem__, field_names)) +
-                       " FROM account_move_line l, account_move m" +\
-                       " WHERE l.account_id IN %s " \
-                       + prefilters + filters +
-                       " GROUP BY l.account_id")
+            request = """SELECT l.account_id as id, %s
+                       FROM account_move_line l, account_move m
+                       WHERE l.account_id IN %%s %s
+                       GROUP BY l.account_id""" % (', '.join(map(mapping.__getitem__, field_names)), prefilters + filters)  # not_a_user_entry
             params = [tuple(children_and_consolidated)]
             if query_params:
                 for qp in query_params:
@@ -197,7 +195,6 @@
                     new_amount = currency_obj.compute(cr, uid, context.get('output_currency_id'), company_currency, res[i].get(f_name), context=context)
                     res[i][f_name] = new_amount
         return res
-    #@@@end
 
     def _get_restricted_area(self, cr, uid, ids, field_name, args, context=None):
         """

=== modified file 'bin/addons/account_override/account_move_line.py'
--- bin/addons/account_override/account_move_line.py	2017-08-21 10:17:48 +0000
+++ bin/addons/account_override/account_move_line.py	2017-10-06 09:59:17 +0000
@@ -101,7 +101,7 @@
         Just used to not break default OpenERP behaviour
         """
         if name and value:
-            sql = "UPDATE "+ self._table + " SET " + name + " = %s WHERE id = %s"
+            sql = "UPDATE "+ self._table + " SET " + name + " = %s WHERE id = %s"  # not_a_user_entry
             cr.execute(sql, (value, aml_id))
         return True
 
@@ -178,9 +178,9 @@
                     FROM account_move_line l1, account_move_line l2
                     WHERE l2.account_id = l1.account_id
                       AND l1.id <= l2.id
-                      AND l2.id IN %s AND """ + \
-            self._query_get(cr, uid, obj='l1', context=c) + \
-            " GROUP BY l2.id"
+                      AND l2.id IN %%s AND %s
+                    GROUP BY l2.id
+                      """ % self._query_get(cr, uid, obj='l1', context=c)  # not_a_user_entry
 
         cr.execute(sql, [tuple(ids)])
         result = dict(cr.fetchall())
@@ -196,7 +196,7 @@
             return []
         where = ' AND '.join(map(lambda x: '(abs(sum(debit_currency-credit_currency))'+x[1]+str(x[2])+')',args))
         cursor.execute('SELECT id, SUM(debit_currency-credit_currency) FROM account_move_line \
-                     GROUP BY id, debit_currency, credit_currency having '+where)
+                     GROUP BY id, debit_currency, credit_currency having '+where)  # not_a_user_entry
         res = cursor.fetchall()
         if not res:
             return [('id', '=', '0')]

=== modified file 'bin/addons/account_override/finance_export.py'
--- bin/addons/account_override/finance_export.py	2017-03-17 13:33:26 +0000
+++ bin/addons/account_override/finance_export.py	2017-10-06 09:59:17 +0000
@@ -234,7 +234,7 @@
                 ids = [x and x[key_column_number] or 0 for x in sqlres]
                 # mark lines as exported
                 if ids:
-                    update_request = 'UPDATE ' + tablename + ' SET exported=\'t\' WHERE id in %s'
+                    update_request = 'UPDATE ' + tablename + ' SET exported=\'t\' WHERE id in %s'  # not_a_user_entry
                     try:
                         cr.execute(update_request, (tuple(ids),))
                     except Exception, e:

=== modified file 'bin/addons/account_override/res_partner.py'
--- bin/addons/account_override/res_partner.py	2016-08-18 08:32:03 +0000
+++ bin/addons/account_override/res_partner.py	2017-10-06 09:59:17 +0000
@@ -42,9 +42,9 @@
         res = False
         sql = "select ml.id from account_move_line ml" \
             " left join account_move m on m.id=ml.move_id" \
-            " where m.state='posted' and ml.partner_id=%d limit 1" % (partner_id, )
+            " where m.state='posted' and ml.partner_id=%s limit 1"
 
-        cr.execute(sql)
+        cr.execute(sql, (partner_id,))
         res = cr.fetchone()
         return res and res[0] > 0 or False
 

=== modified file 'bin/addons/account_payment/account_move_line.py'
--- bin/addons/account_payment/account_move_line.py	2011-06-24 11:32:40 +0000
+++ bin/addons/account_payment/account_move_line.py	2017-10-06 09:59:17 +0000
@@ -71,7 +71,7 @@
                 WHERE type=%s AND active)
             AND reconcile_id IS null
             AND credit > 0
-            AND ''' + where + ' and ' + query), ('payable',)+sql_args )
+            AND ''' + where + ' and ' + query), ('payable',)+sql_args )  # not_a_user_entry
 
         res = cr.fetchall()
         if not res:
@@ -117,4 +117,4 @@
 
 account_move_line()
 
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
\ No newline at end of file
+# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== modified file 'bin/addons/account_payment/account_payment.py'
--- bin/addons/account_payment/account_payment.py	2016-08-18 08:32:03 +0000
+++ bin/addons/account_payment/account_payment.py	2017-10-06 09:59:17 +0000
@@ -225,34 +225,6 @@
                         break
         return result
 
-    def select_by_name(self, cr, uid, ids, name, args, context=None):
-        if not ids: return {}
-        partner_obj = self.pool.get('res.partner')
-
-        cr.execute("""SELECT pl.id, ml.%s
-            FROM account_move_line ml
-                INNER JOIN payment_line pl
-                ON (ml.id = pl.move_line_id)
-                WHERE pl.id IN %%s"""% self.translate(name),
-                   (tuple(ids),))
-        res = dict(cr.fetchall())
-
-        if name == 'partner_id':
-            partner_name = {}
-            for p_id, p_name in partner_obj.name_get(cr, uid,
-                filter(lambda x:x and x != 0,res.values()), context=context):
-                partner_name[p_id] = p_name
-
-            for id in ids:
-                if id in res and partner_name:
-                    res[id] = (res[id],partner_name[res[id]])
-                else:
-                    res[id] = (False,False)
-        else:
-            for id in ids:
-                res.setdefault(id, (False, ""))
-        return res
-
     def _amount(self, cursor, user, ids, name, args, context=None):
         if not ids:
             return {}

=== modified file 'bin/addons/account_period_closing_level/account_period.py'
--- bin/addons/account_period_closing_level/account_period.py	2017-08-28 14:06:27 +0000
+++ bin/addons/account_period_closing_level/account_period.py	2017-10-06 09:59:17 +0000
@@ -47,8 +47,8 @@
         """
         Check that no oustanding unposted entries remain
         """
-        sql = """SELECT COUNT(id) FROM account_move WHERE period_id = %s AND state != 'posted'""" % period_id
-        cr.execute(sql)
+        sql = """SELECT COUNT(id) FROM account_move WHERE period_id = %s AND state != 'posted'"""
+        cr.execute(sql, (period_id,))
         sql_res = cr.fetchall()
         count_moves = sql_res and sql_res[0] and sql_res[0][0] or 0
         if count_moves > 0:
@@ -226,8 +226,8 @@
                 # retrieve currencies for this period (in account_move_lines)
                 sql = """SELECT DISTINCT currency_id
                 FROM account_move_line
-                WHERE period_id = %s""" % period.id
-                cr.execute(sql)
+                WHERE period_id = %s"""
+                cr.execute(sql, (period.id,))
                 res = [x[0] for x in cr.fetchall()]
                 comp_curr_id = self.pool.get('res.users').browse(cr, uid, uid).company_id.currency_id.id
                 # for each currency do a verification about fx rate

=== modified file 'bin/addons/account_reconciliation/account_move_line.py'
--- bin/addons/account_reconciliation/account_move_line.py	2017-08-18 09:42:01 +0000
+++ bin/addons/account_reconciliation/account_move_line.py	2017-10-06 09:59:17 +0000
@@ -509,7 +509,7 @@
                 if d and d[0] and d[0][1]:
                     name = d[0][1]
                 if p or t:
-                    sql = "UPDATE " + self.pool.get('account.move.line')._table + " SET reconcile_txt = %s WHERE id in %s"
+                    sql = "UPDATE " + self.pool.get('account.move.line')._table + " SET reconcile_txt = %s WHERE id in %s"  # not_a_user_entry
                     cr.execute(sql, (name, tuple(p+t)))
         return res
 
@@ -533,7 +533,7 @@
                 if d and d[0] and d[0][1]:
                     name = d[0][1]
                 if p or t:
-                    sql = "UPDATE " + self.pool.get('account.move.line')._table + " SET reconcile_txt = %s WHERE id in %s"
+                    sql = "UPDATE " + self.pool.get('account.move.line')._table + " SET reconcile_txt = %s WHERE id in %s"  # not_a_user_entry
                     cr.execute(sql, (name, tuple(p+t)))
         return res
 

=== modified file 'bin/addons/analytic/analytic.py'
--- bin/addons/analytic/analytic.py	2017-03-10 15:57:47 +0000
+++ bin/addons/analytic/analytic.py	2017-10-06 09:59:17 +0000
@@ -86,9 +86,8 @@
                      COALESCE(SUM(l.unit_amount),0) AS quantity
               FROM account_analytic_account a
                   LEFT JOIN account_analytic_line l ON (a.id = l.account_id)
-              WHERE a.id IN %s
-              """ + where_date + """
-              GROUP BY a.id""", where_clause_args)
+              WHERE a.id IN %%s %s
+              GROUP BY a.id""" % where_date, where_clause_args)  # not_a_user_entry
         for ac_id, debit, credit, balance, quantity in cr.fetchall():
             res[ac_id] = {'debit': debit, 'credit': credit, 'balance': balance, 'quantity': quantity}
         return self._compute_level_tree(cr, uid, ids, child_ids, res, ['debit', 'credit', 'balance', 'quantity'], context)

=== modified file 'bin/addons/analytic_distribution/destination_tools.py'
--- bin/addons/analytic_distribution/destination_tools.py	2017-02-10 08:51:30 +0000
+++ bin/addons/analytic_distribution/destination_tools.py	2017-10-06 09:59:17 +0000
@@ -48,15 +48,14 @@
 
         if self._rel == 'account_destination_link' and not context.get('display_disabled'):
             where_c = " %s AND disabled='f' " % (where_c, )
-        query = 'SELECT %(rel)s.%(id2)s, %(rel)s.%(id1)s \
-                   FROM %(rel)s, %(from_c)s \
-                  WHERE %(rel)s.%(id1)s IN %%s \
-                    AND %(rel)s.%(id2)s = %(tbl)s.id \
-                 %(where_c)s  \
-                 %(order_by)s \
-                 %(limit)s \
-                 OFFSET %(offset)d' \
-            % {'rel': self._rel,
+        query = '''SELECT %(rel)s.%(id2)s, %(rel)s.%(id1)s
+                   FROM %(rel)s, %(from_c)s
+                  WHERE %(rel)s.%(id1)s IN %%s
+                    AND %(rel)s.%(id2)s = %(tbl)s.id
+                 %(where_c)s
+                 %(order_by)s
+                 %(limit)s
+                 OFFSET %(offset)d''' % {'rel': self._rel,  # not_a_user_entry
                'from_c': from_c,
                'tbl': obj._table,
                'id1': self._id1,
@@ -103,15 +102,15 @@
 
                 # JIRA UTP-334
                 if self._rel == 'account_destination_link':
-                    cr.execute('select id from '+self._rel+' where '+self._id1+'=%s AND '+self._id2+' IN (SELECT '+self._rel+'.'+self._id2+' FROM '+self._rel+', '+','.join(tables)+' WHERE '+self._rel+'.'+self._id1+'=%s AND '+self._rel+'.'+self._id2+' = '+obj._table+'.id '+ d1 +' and '+self._rel+'.'+self._id2+' not in %s)', args)
+                    cr.execute('select id from '+self._rel+' where '+self._id1+'=%s AND '+self._id2+' IN (SELECT '+self._rel+'.'+self._id2+' FROM '+self._rel+', '+','.join(tables)+' WHERE '+self._rel+'.'+self._id1+'=%s AND '+self._rel+'.'+self._id2+' = '+obj._table+'.id '+ d1 +' and '+self._rel+'.'+self._id2+' not in %s)', args)  # not_a_user_entry
                     unlink_obj = pooler.get_pool(cr.dbname).get('account.destination.link')
                     for unlinked_id in cr.fetchall():
                         unlink_obj.unlink(cr, user, unlinked_id[0])
                 else:
-                    cr.execute('delete from '+self._rel+' where '+self._id1+'=%s AND '+self._id2+' IN (SELECT '+self._rel+'.'+self._id2+' FROM '+self._rel+', '+','.join(tables)+' WHERE '+self._rel+'.'+self._id1+'=%s AND '+self._rel+'.'+self._id2+' = '+obj._table+'.id '+ d1 +' and '+self._rel+'.'+self._id2+' not in %s)', args)
-
-
-                cr.execute('select '+self._id2+' from '+self._rel+' where '+self._id1+'=%s', [m_id, ])
+                    cr.execute('delete from '+self._rel+' where '+self._id1+'=%s AND '+self._id2+' IN (SELECT '+self._rel+'.'+self._id2+' FROM '+self._rel+', '+','.join(tables)+' WHERE '+self._rel+'.'+self._id1+'=%s AND '+self._rel+'.'+self._id2+' = '+obj._table+'.id '+ d1 +' and '+self._rel+'.'+self._id2+' not in %s)', args)  # not_a_user_entry
+
+
+                cr.execute('select '+self._id2+' from '+self._rel+' where '+self._id1+'=%s', [m_id, ])  # not_a_user_entry
                 existing = [x[0] for x in cr.fetchall()]
 
                 for act_nbr in act[2]:
@@ -120,7 +119,7 @@
                             link_obj = pooler.get_pool(cr.dbname).get('account.destination.link')
                             link_obj.create(cr, user, {self._id1: m_id, self._id2: act_nbr})
                         else:
-                            cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s, %s)', (m_id, act_nbr))
+                            cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s, %s)', (m_id, act_nbr))  # not_a_user_entry
 
             else:
                 newargs.append(act)

=== modified file 'bin/addons/analytic_override/analytic_account.py'
--- bin/addons/analytic_override/analytic_account.py	2017-07-28 12:30:15 +0000
+++ bin/addons/analytic_override/analytic_account.py	2017-10-06 09:59:17 +0000
@@ -156,10 +156,8 @@
                          COALESCE(SUM(l.amount),0) AS balance,
                          COALESCE(SUM(l.unit_amount),0) AS quantity
                   FROM account_analytic_account a
-                      LEFT JOIN account_analytic_line l ON (a.id = l.""" + default_field  + """)
-                  WHERE a.id IN %s
-                  """ + where_date + """
-                  GROUP BY a.id""", where_clause_args)
+                      LEFT JOIN account_analytic_line l ON (a.id = l.%s)
+                  WHERE a.id IN %%s %s GROUP BY a.id""" % (default_field, where_date), where_clause_args)  # ignore_sql_check
             for ac_id, debit, credit, balance, quantity in cr.fetchall():
                 res[ac_id] = {'debit': debit, 'credit': credit, 'balance': balance, 'quantity': quantity}
             tmp_res = self._compute_level_tree(cr, uid, ids, child_ids, res, name, context)
@@ -277,11 +275,11 @@
             ids = [ids]
         if not ids:
             return True
-        cr.execute('''select a.code, a.name, d.name from
-            '''+self._table+''' d
+        cr.execute('''
+            select a.code, a.name, d.name from %s d
             left join account_account a on a.default_destination_id = d.id
             left join account_destination_link l on l.destination_id = d.id and l.account_id = a.id and l.disabled='f'
-            where a.default_destination_id is not null and l.destination_id is null and d.id in %s ''', (tuple(ids),)
+            where a.default_destination_id is not null and l.destination_id is null and d.id in %%s''' % self._table, (tuple(ids),)  # not_a_user_entry
                    )
         error = []
         for x in cr.fetchall():

=== modified file 'bin/addons/analytic_override/analytic_line.py'
--- bin/addons/analytic_override/analytic_line.py	2016-08-22 13:55:25 +0000
+++ bin/addons/analytic_override/analytic_line.py	2017-10-06 09:59:17 +0000
@@ -242,7 +242,7 @@
         br = self.browse(cr, uid, res,context)
         if entry_sequence_sync is not None:
             if entry_sequence_sync != br.entry_sequence:
-                cr.execute('''update account_analytic_line set entry_sequence = '%s' where id = %s''' % (entry_sequence_sync,res))
+                cr.execute('''UPDATE account_analytic_line SET entry_sequence=%s WHERE id=%s''', (entry_sequence_sync, res))
         return res
 
     def write(self, cr, uid, ids, vals, context=None):

=== modified file 'bin/addons/base/ir/ir_attachment.py'
--- bin/addons/base/ir/ir_attachment.py	2017-02-08 16:42:57 +0000
+++ bin/addons/base/ir/ir_attachment.py	2017-10-06 09:59:17 +0000
@@ -61,10 +61,11 @@
         for model, mids in res_ids.items():
             # ignore attachments that are not attached to a resource anymore when checking access rights
             # (resource was deleted but attachment was not)
-            cr.execute('select id from '+self.pool.get(model)._table+' where id in %s', (tuple(mids),))
+            model_obj = self.pool.get(model)
+            cr.execute('select id from '+model_obj._table+' where id in %s', (tuple(mids),))  # not_a_user_entry
             mids = [x[0] for x in cr.fetchall()]
             ima.check(cr, uid, model, mode, context=context)
-            self.pool.get(model).check_access_rule(cr, uid, mids, mode, context=context)
+            model_obj.check_access_rule(cr, uid, mids, mode, context=context)
 
     def search(self, cr, uid, args, offset=0, limit=None, order=None,
                context=None, count=False):

=== modified file 'bin/addons/base/ir/ir_cron.py'
--- bin/addons/base/ir/ir_cron.py	2017-08-21 09:41:05 +0000
+++ bin/addons/base/ir/ir_cron.py	2017-10-06 09:59:17 +0000
@@ -133,7 +133,7 @@
                     addsql = ''
                     if not numbercall:
                         addsql = ', active=False'
-                    cr.execute("update ir_cron set nextcall=%s, numbercall=%s"+addsql+" where id=%s", (nextcall.strftime('%Y-%m-%d %H:%M:%S'), numbercall, job['id']))
+                    cr.execute("update ir_cron set nextcall=%s, numbercall=%s"+addsql+" where id=%s", (nextcall.strftime('%Y-%m-%d %H:%M:%S'), numbercall, job['id']))  # not_a_user_entry
                     cr.commit()
 
 

=== modified file 'bin/addons/base/ir/ir_model.py'
--- bin/addons/base/ir/ir_model.py	2017-05-12 15:07:08 +0000
+++ bin/addons/base/ir/ir_model.py	2017-10-06 09:59:17 +0000
@@ -392,7 +392,7 @@
         res = super(ir_model_fields,self).write(cr, user, ids, vals, context=context)
 
         if column_rename:
-            cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO "%s"' % column_rename[1])
+            cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO "%s"' % column_rename[1])  # not_a_user_entry
             # This is VERY risky, but let us have this feature:
             # we want to change the key of column in obj._columns dict
             col = column_rename[0]._columns.pop(column_rename[1][1]) # take object out, w/o copy
@@ -498,17 +498,17 @@
         if isinstance(group_ids, (int, long)):
             group_ids = [group_ids]
         for group_id in group_ids:
-            cr.execute("SELECT perm_" + mode + " "
-                       "  FROM ir_model_access a "
-                       "  JOIN ir_model m ON (m.id = a.model_id) "
-                       " WHERE m.model = %s AND a.group_id = %s", (model_name, group_id)
+            cr.execute("""SELECT perm_%s
+                         FROM ir_model_access a
+                         JOIN ir_model m ON (m.id = a.model_id)
+                        WHERE m.model = %%s AND a.group_id = %%s""" % mode, (model_name, group_id)  # not_a_user_entry
                        )
             r = cr.fetchone()
             if r is None:
-                cr.execute("SELECT perm_" + mode + " "
-                           "  FROM ir_model_access a "
-                           "  JOIN ir_model m ON (m.id = a.model_id) "
-                           " WHERE m.model = %s AND a.group_id IS NULL", (model_name, )
+                cr.execute("""SELECT perm_%s
+                             FROM ir_model_access a
+                             JOIN ir_model m ON (m.id = a.model_id)
+                            WHERE m.model = %%s AND a.group_id IS NULL""" % mode, (model_name, )  # not_a_user_entry
                            )
                 r = cr.fetchone()
 
@@ -539,23 +539,23 @@
             return True
 
         # We check if a specific rule exists
-        cr.execute('SELECT MAX(CASE WHEN perm_' + mode + ' THEN 1 ELSE 0 END) '
-                   '  FROM ir_model_access a '
-                   '  JOIN ir_model m ON (m.id = a.model_id) '
-                   '  JOIN res_groups_users_rel gu ON (gu.gid = a.group_id) '
-                   ' WHERE m.model = %s '
-                   '   AND gu.uid = %s '
+        cr.execute('''SELECT MAX(CASE WHEN perm_%s THEN 1 ELSE 0 END)
+                     FROM ir_model_access a
+                     JOIN ir_model m ON (m.id = a.model_id)
+                     JOIN res_groups_users_rel gu ON (gu.gid = a.group_id)
+                    WHERE m.model = %%s
+                      AND gu.uid = %%s''' % mode  # not_a_user_entry
                    , (model_name, uid,)
                    )
         r = cr.fetchone()[0]
 
         if r is None:
             # there is no specific rule. We check the generic rule
-            cr.execute('SELECT MAX(CASE WHEN perm_' + mode + ' THEN 1 ELSE 0 END) '
-                       '  FROM ir_model_access a '
-                       '  JOIN ir_model m ON (m.id = a.model_id) '
-                       ' WHERE a.group_id IS NULL '
-                       '   AND m.model = %s '
+            cr.execute('''SELECT MAX(CASE WHEN perm_%s THEN 1 ELSE 0 END)
+                         FROM ir_model_access a
+                         JOIN ir_model m ON (m.id = a.model_id)
+                        WHERE a.group_id IS NULL
+                          AND m.model = %%s ''' % mode  # not_a_user_entry
                        , (model_name,)
                        )
             r = cr.fetchone()[0]
@@ -564,12 +564,12 @@
             cr.execute('''select
                     g.name
                 from
-                    ir_model_access a 
-                    left join ir_model m on (a.model_id=m.id) 
+                    ir_model_access a
+                    left join ir_model m on (a.model_id=m.id)
                     left join res_groups g on (a.group_id=g.id)
                 where
-                    m.model=%s and
-                    a.group_id is not null and perm_''' + mode, (model_name, ))
+                    m.model=%%s and
+                    a.group_id is not null and perm_%s''' % mode, (model_name, ))  # not_a_user_entry
             groups = ', '.join(map(lambda x: x[0], cr.fetchall())) or '/'
             msgs = {
                 'read':   _("You can not read this document (%s) ! Be sure your user belongs to one of these groups: %s."),
@@ -730,7 +730,7 @@
         if xml_id:
             cr.execute('''SELECT imd.id, imd.res_id, md.id
                           FROM ir_model_data imd LEFT JOIN %s md ON (imd.res_id = md.id)
-                          WHERE imd.module=%%s AND imd.name=%%s''' % model_obj._table,
+                          WHERE imd.module=%%s AND imd.name=%%s''' % model_obj._table,  # not_a_user_entry
                        (module, xml_id))
             results = cr.fetchall()
             for imd_id2,res_id2,real_id2 in results:
@@ -831,20 +831,19 @@
         else:
             where += ' and (key2 is null)'
 
-        cr.execute('select * from ir_values where model=%s and key=%s and name=%s'+where,(model, key, name))
+        cr.execute('select * from ir_values where model=%s and key=%s and name=%s'+where,(model, key, name))  # not_a_user_entry
         res = cr.fetchone()
         if not res:
             res = ir.ir_set(cr, uid, key, key2, name, models, value, replace, isobject, meta)
         elif xml_id:
-            cr.execute('UPDATE ir_values set value=%s WHERE model=%s and key=%s and name=%s'+where,(value, model, key, name))
+            cr.execute('UPDATE ir_values set value=%s WHERE model=%s and key=%s and name=%s'+where,(value, model, key, name))  # not_a_user_entry
         return True
 
     def _process_end(self, cr, uid, modules):
         if not modules:
             return True
         modules = list(modules)
-        module_in = ",".join(["%s"] * len(modules))
-        cr.execute('select id,name,model,res_id,module from ir_model_data where module IN (' + module_in + ') and noupdate=%s', modules + [False])
+        cr.execute('select id,name,model,res_id,module from ir_model_data where module IN %s and noupdate=%s', (tuple(modules), False))
         wkf_todo = []
         for (id, name, model, res_id,module) in cr.fetchall():
             if (module,name) not in self.loads:

=== modified file 'bin/addons/base/ir/ir_rule.py'
--- bin/addons/base/ir/ir_rule.py	2017-05-12 14:01:09 +0000
+++ bin/addons/base/ir/ir_rule.py	2017-10-06 09:59:17 +0000
@@ -106,11 +106,11 @@
         cr.execute("""SELECT r.id
                 FROM ir_rule r
                 JOIN ir_model m ON (r.model_id = m.id)
-                WHERE m.model = %s
-                AND r.perm_""" + mode + """
+                WHERE m.model = %%s
+                AND r.perm_%s
                 AND (r.id IN (SELECT rule_group_id FROM rule_group_rel g_rel
                             JOIN res_groups_users_rel u_rel ON (g_rel.group_id = u_rel.gid)
-                            WHERE u_rel.uid = %s) OR r.global)""", (model_name, uid))
+                            WHERE u_rel.uid = %%s) OR r.global)""" % mode, (model_name, uid))  # not_a_user_entry
         ids = map(lambda x: x[0], cr.fetchall())
         if ids:
             for rule in self.browse(cr, uid, ids):

=== modified file 'bin/addons/base/ir/ir_sequence.py'
--- bin/addons/base/ir/ir_sequence.py	2017-06-14 13:37:10 +0000
+++ bin/addons/base/ir/ir_sequence.py	2017-10-06 09:59:17 +0000
@@ -46,7 +46,7 @@
             else:
                 # currval can't be used as it returns the value
                 # most recently obtained by nextval for this sequence in the current session
-                cr.execute("select last_value, is_called, increment_by from ir_sequence_%03d" % seq['id'])
+                cr.execute("select last_value, is_called, increment_by from ir_sequence_%03d" % seq['id'])  # not_a_user_entry
                 data = cr.fetchone()
                 ret[seq['id']] = data[0]
                 if data[1]:
@@ -104,7 +104,7 @@
         if number_increment == 0:
             raise osv.except_osv(_('Warning!'),_("Increment number must not be zero."))
         assert isinstance(id, (int, long))
-        sql = "CREATE SEQUENCE ir_sequence_%03d INCREMENT BY %%s START WITH %%s" % id
+        sql = "CREATE SEQUENCE ir_sequence_%03d INCREMENT BY %%s START WITH %%s" % id  # not_a_user_entry
         cr.execute(sql, (number_increment, number_next))
 
     def _drop_sequence(self, cr, ids):
@@ -117,7 +117,7 @@
 
         # RESTRICT is the default; it prevents dropping the sequence if an
         # object depends on it.
-        cr.execute("DROP SEQUENCE IF EXISTS %s RESTRICT " % names)
+        cr.execute("DROP SEQUENCE IF EXISTS %s RESTRICT " % names)  # not_a_user_entry
 
     def _alter_sequence(self, cr, id, number_increment):
         """ Alter a PostreSQL sequence.
@@ -129,7 +129,7 @@
         assert isinstance(id, (int, long))
         cr.execute("""
             ALTER SEQUENCE ir_sequence_%03d INCREMENT BY %%s
-            """ % id, (number_increment,))
+            """ % id, (number_increment,))  # not_a_user_entry
 
     def create(self, cr, uid, values, context=None):
         values = self._add_missing_default_values(cr, uid, values, context)
@@ -162,7 +162,7 @@
                         self._alter_sequence(cr, row['id'], i)
                 else:
                     self._drop_sequence(cr, row['id'])
-                    cr.execute('update %s set number_next=%%s where id=%%s ' % (self._table, ), (n, row['id']))
+                    cr.execute('update %s set number_next=%%s where id=%%s ' % (self._table, ), (n, row['id']))  # not_a_user_entry
             else:
                 if new_implementation in ('no_gap', None):
                     pass
@@ -201,7 +201,7 @@
         if context is None:
             context = {}
         if seq['implementation'] == 'psql':
-            cr.execute("SELECT nextval('ir_sequence_%03d')" % seq['id'])
+            cr.execute("SELECT nextval('ir_sequence_%03d')" % seq['id'])  # not_a_user_entry
             seq['number_next'] = cr.fetchone()
         else:
             cr.execute("SELECT number_next FROM ir_sequence WHERE id=%s FOR UPDATE NOWAIT", (seq['id'],))
@@ -229,7 +229,7 @@
             WHERE %s=%%s
               AND active=true
               AND (company_id in %%s or company_id is NULL)
-            ORDER BY company_id, id''' % code_or_id, (sequence_code_or_id, tuple(company_ids)))
+            ORDER BY company_id, id''' % code_or_id, (sequence_code_or_id, tuple(company_ids)))  # not_a_user_entry
         res = cr.dictfetchone()
         return self._next(cr, uid, res, context=context)
 

=== modified file 'bin/addons/base/ir/ir_values.py'
--- bin/addons/base/ir/ir_values.py	2017-04-06 09:08:50 +0000
+++ bin/addons/base/ir/ir_values.py	2017-10-06 09:59:17 +0000
@@ -213,7 +213,7 @@
                 where.append('(user_id=%s or (user_id IS NULL)) order by sequence,id')
                 params.append(uid)
             clause = ' and '.join(where)
-            cr.execute('select id,name,value,object,meta, key from ir_values where ' + clause, params)
+            cr.execute('select id,name,value,object,meta, key from ir_values where ' + clause, params)  # not_a_user_entry
             result = cr.fetchall()
             if result:
                 break

=== modified file 'bin/addons/base/ir/workflow/print_instance.py'
--- bin/addons/base/ir/workflow/print_instance.py	2011-03-03 12:55:06 +0000
+++ bin/addons/base/ir/workflow/print_instance.py	2017-10-06 09:59:17 +0000
@@ -27,7 +27,7 @@
 
 def graph_get(cr, graph, wkf_ids, nested, workitem, processed_subflows):
     import pydot
-    cr.execute('select * from wkf_activity where wkf_id in ('+','.join(['%s']*len(wkf_ids))+')', wkf_ids)
+    cr.execute('select * from wkf_activity where wkf_id in %s', (tuple(wkf_ids),))
     nodes = cr.dictfetchall()
     activities = {}
     actfrom = {}
@@ -92,9 +92,9 @@
         activity_to = actto[t['act_to']][1].get(t['signal'], actto[t['act_to']][0])
         graph.add_edge(pydot.Edge( str(activity_from) ,str(activity_to), fontsize='10', **args))
     nodes = cr.dictfetchall()
-    cr.execute('select * from wkf_activity where flow_start=True and wkf_id in ('+','.join(['%s']*len(wkf_ids))+')', wkf_ids)
+    cr.execute('select * from wkf_activity where flow_start=True and wkf_id in %s', (tuple(wkf_ids),))
     start = cr.fetchone()[0]
-    cr.execute("select 'subflow.'||name,id from wkf_activity where flow_stop=True and wkf_id in ("+','.join(['%s']*len(wkf_ids))+')', wkf_ids)
+    cr.execute("select 'subflow.'||name,id from wkf_activity where flow_stop=True and wkf_id in %s", (tuple(wkf_ids),))
     stop = cr.fetchall()
     if (stop):
         stop = (stop[0][1], dict(stop))

=== modified file 'bin/addons/base/res/res_log.py'
--- bin/addons/base/res/res_log.py	2012-04-03 15:17:47 +0000
+++ bin/addons/base/res/res_log.py	2017-10-06 09:59:17 +0000
@@ -48,8 +48,7 @@
         cr.execute('SELECT 1 FROM pg_indexes WHERE indexname=%s',
                    (self._index_name,))
         if not cr.fetchone():
-            cr.execute('CREATE INDEX %s ON res_log (user_id, read)' %
-                       self._index_name)
+            cr.execute('CREATE INDEX %s ON res_log (user_id, read)' % self._index_name)  # not_a_user_entry
 
     def create(self, cr, uid, vals, context=None):
         create_context = context and dict(context) or {}

=== modified file 'bin/addons/consumption_calculation/consumption_calculation.py'
--- bin/addons/consumption_calculation/consumption_calculation.py	2017-05-24 16:07:06 +0000
+++ bin/addons/consumption_calculation/consumption_calculation.py	2017-10-06 09:59:17 +0000
@@ -270,7 +270,7 @@
                             LEFT JOIN product_product p ON l.product_id = p.id
                             LEFT JOIN product_template t ON p.product_tmpl_id = t.id
                             LEFT JOIN real_average_consumption rac ON l.rac_id = rac.id
-                          WHERE (t.type != 'service_recep' %s) AND rac.id in %%s LIMIT 1''' % transport_cat,
+                          WHERE (t.type != 'service_recep' %s) AND rac.id in %%s LIMIT 1''' % transport_cat,  # not_a_user_entry
                        (tuple(ids),))
             res = cr.fetchall()
 
@@ -802,7 +802,7 @@
                     # uf-1344 "quantity NOT in stock with this ED => line should be in red, no batch picked up"
                     prodlot_id = None
             #recursion: can't use write
-            cr.execute('UPDATE '+self._table+' SET product_qty=%s, batch_mandatory=%s, date_mandatory=%s, asset_mandatory=%s, prodlot_id=%s, expiry_date=%s, asset_id=%s  where id=%s', (product_qty, batch_mandatory, date_mandatory, asset_mandatory, prodlot_id, expiry_date, asset_id, obj.id))
+            cr.execute('UPDATE '+self._table+' SET product_qty=%s, batch_mandatory=%s, date_mandatory=%s, asset_mandatory=%s, prodlot_id=%s, expiry_date=%s, asset_id=%s  where id=%s', (product_qty, batch_mandatory, date_mandatory, asset_mandatory, prodlot_id, expiry_date, asset_id, obj.id))  # not_a_user_entry
 
         return True
 

=== modified file 'bin/addons/data_finance/import_analytic_lines.py'
--- bin/addons/data_finance/import_analytic_lines.py	2015-11-03 12:55:51 +0000
+++ bin/addons/data_finance/import_analytic_lines.py	2017-10-06 09:59:17 +0000
@@ -106,7 +106,7 @@
                                                 ('type', '=', 'bank'),
                                                 ('is_current_instance', '=', True)])
             if not jids:
-                cr.execute('SELECT max(code) from account_account where parent_id=%s'%(parent_account,))
+                cr.execute('SELECT max(code) from account_account where parent_id=%s', (parent_account,))
 
                 code = int(cr.fetchone()[0])+1
                 acc_id = account_obj.create(cr, uid, {

=== modified file 'bin/addons/finance/wizard/account_report_partner_balance_tree.py'
--- bin/addons/finance/wizard/account_report_partner_balance_tree.py	2017-06-12 09:56:20 +0000
+++ bin/addons/finance/wizard/account_report_partner_balance_tree.py	2017-10-06 09:59:17 +0000
@@ -76,7 +76,7 @@
             " " + self.PARTNER_REQUEST + " "
             " " + self.TAX_REQUEST + " "
             " " + self.IB_JOURNAL_REQUEST + " "
-            " " + self.IB_DATE_TO + " "
+            " " + self.IB_DATE_TO + " "  # not_a_user_entry
             "GROUP BY ac.type, p.id, p.ref, p.name, ac.name, ac.code "
             "ORDER BY ac.type, p.name ",
             (tuple(self.ib_move_state_list),))
@@ -216,25 +216,23 @@
         # inspired from account_report_balance.py report query
         # but group only per 'account type'/'partner'
         where = where and 'AND %s' % where or ''
-        query = "SELECT ac.type as account_type," \
-            " p.id as partner_id, p.ref as partner_ref, p.name as partner_name," \
-            " COALESCE(sum(debit),0) AS debit, COALESCE(sum(credit), 0) AS credit," \
-            " CASE WHEN sum(debit) > sum(credit) THEN sum(debit) - sum(credit) ELSE 0 END AS sdebit," \
-            " CASE WHEN sum(debit) < sum(credit) THEN sum(credit) - sum(debit) ELSE 0 END AS scredit" \
-            " FROM account_move_line l INNER JOIN res_partner p ON (l.partner_id=p.id)" \
-            " JOIN account_account ac ON (l.account_id = ac.id)" \
-            " JOIN account_move am ON (am.id = l.move_id)" \
-            " JOIN account_account_type at ON (ac.user_type = at.id)" \
-            " WHERE ac.type IN " + self.account_type + "" \
-            " AND am.state IN " + move_state + "" \
-            " " + where + "" \
-            " " + self.INSTANCE_REQUEST + " " \
-            " " + self.TAX_REQUEST + " " \
-            " " + self.PARTNER_REQUEST + " " \
-            " " + self.ACCOUNT_REQUEST + " " \
-            " " + self.RECONCILE_REQUEST + " " \
-            " GROUP BY ac.type,p.id,p.ref,p.name" \
-            " ORDER BY ac.type,p.name"
+        query = """SELECT ac.type as account_type,
+            p.id as partner_id, p.ref as partner_ref, p.name as partner_name,
+            COALESCE(sum(debit),0) AS debit, COALESCE(sum(credit), 0) AS credit,
+            CASE WHEN sum(debit) > sum(credit) THEN sum(debit) - sum(credit) ELSE 0 END AS sdebit,
+            CASE WHEN sum(debit) < sum(credit) THEN sum(credit) - sum(debit) ELSE 0 END AS scredit
+            FROM account_move_line l INNER JOIN res_partner p ON (l.partner_id=p.id)
+            JOIN account_account ac ON (l.account_id = ac.id)
+            JOIN account_move am ON (am.id = l.move_id)
+            JOIN account_account_type at ON (ac.user_type = at.id)
+            WHERE ac.type IN %s
+            AND am.state IN %s
+            %s %s %s %s %s %s
+            GROUP BY ac.type,p.id,p.ref,p.name
+            ORDER BY ac.type,p.name""" % (self.account_type, move_state,  # not_a_user_entry
+                    where, self.INSTANCE_REQUEST, self.TAX_REQUEST,
+                    self.PARTNER_REQUEST, self.ACCOUNT_REQUEST,
+                    self.RECONCILE_REQUEST)
         cr.execute(query)
         res = cr.dictfetchall()
 
@@ -460,13 +458,14 @@
         # recalculate the result only if the criteria have changed
         if not self.total_debit_credit_balance or account_type != self.total_debit_credit_balance['account_type'] \
                 or data != self.total_debit_credit_balance['data']:
-            query = "SELECT" \
-                " sum(debit) AS debit, sum(credit) AS credit, sum(balance) as balance" \
-                " FROM account_partner_balance_tree" \
-                " WHERE account_type IN ('" + account_type + "')" \
-                " AND uid = " + str(uid) + "" \
-                " AND build_ts='" + data['build_ts'] + "'"
-            cr.execute(query)
+            query = """SELECT
+                sum(debit) AS debit, sum(credit) AS credit, sum(balance) as balance
+                FROM account_partner_balance_tree
+                WHERE account_type IN ('%s')
+                AND uid = %%s
+                AND build_ts=%%s
+                """ % account_type  # not_a_user_entry
+            cr.execute(query, (uid, data['build_ts']))
             res = cr.dictfetchall()
             self.total_debit_credit_balance['account_type'] = account_type
             self.total_debit_credit_balance['data'] = data

=== modified file 'bin/addons/financing_contract/contract.py'
--- bin/addons/financing_contract/contract.py	2017-03-06 08:36:33 +0000
+++ bin/addons/financing_contract/contract.py	2017-10-06 09:59:17 +0000
@@ -656,7 +656,7 @@
 
         res = super(financing_contract_contract, self).write(cr, uid, ids, vals, context=context)
         if fp_added_flag: # if the previous save has been recovered thanks to the flag set to True, then reset it back to False
-            cr.execute('''update financing_contract_contract set fp_added_flag = 'f' where id = %s''' % (ids[0]))
+            cr.execute('''update financing_contract_contract set fp_added_flag = 'f' where id = %s''', (ids[0],))
 
         # uf-2342 delete any assigned quads that are no longer valid due to changes in the contract
         # get list of all valid ids for this contract

=== modified file 'bin/addons/financing_contract/financing_contract_account_quadruplet.py'
--- bin/addons/financing_contract/financing_contract_account_quadruplet.py	2017-02-10 08:51:30 +0000
+++ bin/addons/financing_contract/financing_contract_account_quadruplet.py	2017-10-06 09:59:17 +0000
@@ -68,7 +68,7 @@
         cr.execute('''select account_quadruplet_id
                         from financing_contract_actual_account_quadruplets
                         where actual_line_id in (select id from financing_contract_format_line
-                                                where format_id = %s and is_quadruplet is true)''' % (contract.format_id.id))
+                                                where format_id = %s and is_quadruplet is true)''', (contract.format_id.id,))
         rows = cr.fetchall()
         for id in [x[0] for x in rows]:
             exclude[id] = True
@@ -111,7 +111,7 @@
                                 from financing_contract_cost_center cc
                                 where cc.contract_id = %s
                                 and cc.cost_center_id =
-                                    financing_contract_account_quadruplet.cost_center_id)''' % (contract.format_id.id,contract.format_id.id))
+                                    financing_contract_account_quadruplet.cost_center_id)''', (contract.format_id.id,contract.format_id.id))
         for id in [x[0] for x in cr.fetchall()]:
             exclude[id] = True
         for id in ids:
@@ -140,7 +140,7 @@
                                 from financing_contract_cost_center cc
                                 where cc.contract_id = %s
                                 and cc.cost_center_id =
-                                    financing_contract_account_quadruplet.cost_center_id)''' % (contract.format_id.id,contract.format_id.id))
+                                    financing_contract_account_quadruplet.cost_center_id)''', (contract.format_id.id,contract.format_id.id))
         someids = []
         someids += [x[0] for x in cr.fetchall()]
         return [('id','in',someids)]
@@ -170,7 +170,7 @@
                                                           financing_contract_format_line l
                                                           where c.id = %s
                                                           and f.id = c.format_id
-                                                          and l.format_id = f.id)''' % (contract.format_id.id))
+                                                          and l.format_id = f.id)''', (contract.format_id.id,))
                     exclude += [x[0] for x in cr.fetchall()]
                 for account_quadruplet in line.account_quadruplet_ids:
                     exclude.append(account_quadruplet.id)

=== modified file 'bin/addons/mission_stock/mission_stock.py'
--- bin/addons/mission_stock/mission_stock.py	2017-06-01 07:31:06 +0000
+++ bin/addons/mission_stock/mission_stock.py	2017-10-06 09:59:17 +0000
@@ -579,7 +579,7 @@
                                 FROM
                                 stock_mission_report_line smrl WHERE mission_report_id = %s
                                 AND p.id = smrl.product_id)
-                            ''' % report['id'])
+                            ''', (report['id'],))
                 for product, prod_state, prod_active, prod_state_ud, prod_creator in cr.fetchall():
                     line_obj.create(cr, uid, {
                         'product_id': product,
@@ -725,11 +725,10 @@
                         FROM stock_move
                         WHERE state = 'done'
                         AND id not in (SELECT move_id FROM mission_move_rel WHERE mission_id = %s)
-            ''' % (report_id))
+            ''', (report_id,))
             res = cr.fetchall()
             for move in res:
-                cr.execute('INSERT INTO mission_move_rel VALUES (%s, %s)' %
-                           (report_id, move[0]))
+                cr.execute('INSERT INTO mission_move_rel VALUES (%s, %s)', (report_id, move[0]))
                 product = product_obj.browse(cr, uid, move[1],
                                              fields_to_fetch=['uom_id', 'standard_price'])
                 line_id = line_obj.search(cr, uid, [('product_id', '=', move[1]),
@@ -1155,7 +1154,7 @@
                     central_qty=%s, cross_qty=%s, secondary_qty=%s,
                     cu_qty=%s, in_pipe_qty=%s, in_pipe_coor_qty=%s,
                     wh_qty=%s
-                    WHERE id=%s""" % (line[1] or 0.00, line[2] or 0.00,
+                    WHERE id=%s""" % (line[1] or 0.00, line[2] or 0.00,  # not_a_user_entry
                                       line[3] or 0.00,line[4] or 0.00, line[5] or 0.00,line[6] or 0.00,line[7] or 0.00,line[8] or 0.00, (line[2] or 0.00) + (line[3] or 0.00), line_id))
         return True
 

=== modified file 'bin/addons/msf_budget/msf_budget_line.py'
--- bin/addons/msf_budget/msf_budget_line.py	2017-02-20 09:54:19 +0000
+++ bin/addons/msf_budget/msf_budget_line.py	2017-10-06 09:59:17 +0000
@@ -319,10 +319,10 @@
         if budget_ok:
             month_names = self._get_month_names(month_number)
             sql = """
-            SELECT id, COALESCE(""" + '+'.join(month_names) + """, 0.0)
+            SELECT id, COALESCE(%s, 0.0)
             FROM msf_budget_line
-            WHERE id IN %s;
-            """
+            WHERE id IN %%s;
+            """ % '+'.join(month_names)  # not_a_user_entry
             cr.execute(sql, (tuple(ids),))
             tmp_res = cr.fetchall()
             if tmp_res:
@@ -366,9 +366,9 @@
         # Prepare some values
         res = {}
         sql = """
-            SELECT id, COALESCE(""" + '+'.join(month_names) + """, 0.0)
+            SELECT id, COALESCE(%s, 0.0)
             FROM msf_budget_line
-            WHERE id IN %s"""
+            WHERE id IN %%s""" % '+'.join(month_names)  # not_a_user_entry
         cr.execute(sql, (tuple(ids),))
         tmp_res = cr.fetchall()
         if tmp_res:

=== modified file 'bin/addons/msf_cross_docking/cross_docking.py'
--- bin/addons/msf_cross_docking/cross_docking.py	2016-08-18 08:32:03 +0000
+++ bin/addons/msf_cross_docking/cross_docking.py	2017-10-06 09:59:17 +0000
@@ -200,7 +200,7 @@
                             LEFT JOIN product_product p ON l.product_id = p.id
                             LEFT JOIN product_template t ON p.product_tmpl_id = t.id
                             LEFT JOIN purchase_order po ON l.order_id = po.id
-                          WHERE (t.type != 'service_recep' %s) AND po.id in %%s LIMIT 1''' % transport_cat,
+                          WHERE (t.type != 'service_recep' %s) AND po.id in %%s LIMIT 1''' % transport_cat,  # not_a_user_entry
                        (tuple(ids),))
             res = cr.fetchall()
 

=== modified file 'bin/addons/msf_outgoing/msf_outgoing.py'
--- bin/addons/msf_outgoing/msf_outgoing.py	2017-09-03 15:15:05 +0000
+++ bin/addons/msf_outgoing/msf_outgoing.py	2017-10-06 09:59:17 +0000
@@ -267,7 +267,7 @@
         ) t
         group by t.id
         having sum(case when t.tp != 0 then  t.tp - t.fp + 1 else 0 end) %s %s
-''' % (args[0][1], args[0][2]))
+''' % (args[0][1], args[0][2]))  # not_a_user_entry
         return [('id', 'in', [x[0] for x in cr.fetchall()])]
 
     def _get_is_company(self, cr, uid, ids, field_name, args, context=None):
@@ -1661,7 +1661,7 @@
                 pick_obj._hook_create_sync_messages(cr, uid, packing.id, context)  # UF-1617: Create the sync message for batch and asset before shipping
 
                 # UF-1617: set the flag to this packing object to indicate that the SHIP has been done, for synchronisation purpose
-                cr.execute('update stock_picking set already_shipped=\'t\' where id=%s' % packing.id)
+                cr.execute('update stock_picking set already_shipped=\'t\' where id=%s', (packing.id,))
 
 
             # Create automatically the invoice
@@ -2681,26 +2681,15 @@
         return created_ids
 
     def get_current_pick_sequence_for_rw(self, cr, uid, picking_type, context=None):
-        cr.execute('SELECT id FROM ir_sequence WHERE code=\'' + picking_type + '\' and active=true ORDER BY id')
+        cr.execute('SELECT id FROM ir_sequence WHERE code=%s and active=true ORDER BY id', (picking_type,))
         res = cr.dictfetchone()
         if res and res['id']:
-            cr.execute("SELECT last_value from ir_sequence_%03d" % res['id'])
+            cr.execute("SELECT last_value from ir_sequence_%03d" % res['id'])  # not_a_user_entry
             res = cr.dictfetchone()
             if res and res['last_value']:
                 return res['last_value']
         return False
 
-    def alter_sequence_for_rw_pick(self, cr, uid, picking_type, value_to_force, context=None):
-        if not self._get_usb_entity_type(cr, uid, context):
-            return
-
-        cr.execute('SELECT id FROM ir_sequence WHERE code=\'' + picking_type + '\' and active=true ORDER BY id')
-        res = cr.dictfetchone()
-        if res and res['id']:
-            seq = 'ir_sequence_%03d' % res['id']
-            cr.execute("ALTER SEQUENCE " + seq +" RESTART WITH " + str(value_to_force))
-        return
-
     def create(self, cr, uid, vals, context=None):
         '''
         creation of a stock.picking of subtype 'packing' triggers
@@ -5212,7 +5201,7 @@
             if isinstance(ids, (int, long)):
                 ids = [ids]
 
-            cr.execute('select id, move_lines from ' + self._table + ' where id in %s', (tuple(ids),))
+            cr.execute('select id, move_lines from ' + self._table + ' where id in %s', (tuple(ids),))  # not_a_user_entry
             for q_result in cr.fetchall():
                 result[q_result[0]]['move_lines'] = q_result[1] or []
         return result

=== modified file 'bin/addons/msf_outgoing/wizard/incoming_shipment_processor.py'
--- bin/addons/msf_outgoing/wizard/incoming_shipment_processor.py	2017-01-23 16:14:11 +0000
+++ bin/addons/msf_outgoing/wizard/incoming_shipment_processor.py	2017-10-06 09:59:17 +0000
@@ -504,7 +504,7 @@
         Just used to not break default OpenERP behaviour
         """
         if name and value:
-            sql = "UPDATE "+ self._table + " SET " + name + " = %s WHERE id = %s"
+            sql = "UPDATE "+ self._table + " SET " + name + " = %s WHERE id = %s"  # not_a_user_entry
             cr.execute(sql, (value, ml_id))
         return True
 

=== modified file 'bin/addons/msf_profile/msf_profile.py'
--- bin/addons/msf_profile/msf_profile.py	2017-09-08 15:51:54 +0000
+++ bin/addons/msf_profile/msf_profile.py	2017-10-06 09:59:17 +0000
@@ -287,7 +287,7 @@
                 self._logger.warn('The objects linked to the model(s) %s will be removed from ir_model_data.' % model_to_remove_pp)
 
                 for model in model_to_remove:
-                    cr.execute("DELETE FROM ir_model_data WHERE model='%s' AND module='sd'" % model)
+                    cr.execute("DELETE FROM ir_model_data WHERE model=%s AND module='sd'", (model,))
                     current_count = cr.rowcount
                     removed_obj += current_count
                     self._logger.warn('ir.model.data, model=%s, %s objects deleted.' % (model, current_count))
@@ -366,7 +366,7 @@
                         and d.model='res.partner'
                         and name not in ('msf_doc_import_supplier_tbd', 'order_types_res_partner_local_market')
                         and name not like '%s%%'
-                    ) """ % (identifier, ))
+                    ) """ % (identifier, ))  # not_a_user_entry
                 self._logger.warn('%s non local partners updated' % (cr.rowcount,))
         return True
 
@@ -1277,22 +1277,22 @@
                 cr.execute("""update ir_model_data set last_modification=NOW() where module='sd' and model='ir.translation' and res_id in (
                     select id from ir_translation t where t.lang in ('en_MF', 'fr_MF') and name='product.template,name' and res_id in
                     (select t.id from product_template t, product_product p where p.product_tmpl_id = t.id and international_status=6)
-                    and name like '"""+instance_id+"""%'
-                )""")
+                    and name like '%s%%'
+                )""" % instance_id)  # not_a_user_entry
                 cr.execute("""delete from ir_translation t
                     where t.lang in ('en_MF', 'fr_MF') and name='product.template,name' and res_id in
                         (select t.id from product_template t, product_product p where p.product_tmpl_id = t.id and international_status=6)
                     and id in
-                        (select d.res_id from ir_model_data d where d.module='sd' and d.model='ir.translation' and name like '"""+instance_id+"""%')
-                """)
+                        (select d.res_id from ir_model_data d where d.module='sd' and d.model='ir.translation' and name like '%s%%')
+                """ % instance_id)  # not_a_user_entry
                 if coordo_id and instance_name in ('OCBHT118', 'OCBHT143'):
                     # also remove old UniData trans sent by coordo
                     cr.execute("""delete from ir_translation t
                         where t.lang in ('en_MF', 'fr_MF') and name='product.template,name' and res_id in
                             (select t.id from product_template t, product_product p where p.product_tmpl_id = t.id and international_status=6)
                         and id in
-                            (select d.res_id from ir_model_data d where d.module='sd' and d.model='ir.translation' and name like '"""+coordo_id+"""%')
-                    """)
+                            (select d.res_id from ir_model_data d where d.module='sd' and d.model='ir.translation' and name like '%s%%')
+                    """ % coordo_id)  # not_a_user_entry
 
                 self._logger.warn('%s local translation for UniData products deleted' % (cr.rowcount,))
 
@@ -1423,7 +1423,7 @@
         SET touched = '[''state_ud'', ''product_active'', ''international_status_code'']', last_modification = now()
         WHERE model = 'stock.mission.report.line' AND res_id IN (
           SELECT id FROM stock_mission_report_line WHERE mission_report_id IN %s)
-        ''' % (tuple(smr_ids),))
+        ''', (tuple(smr_ids),))
 
         return True
 
@@ -1711,10 +1711,8 @@
 
     def set_config(self, cr):
         data = ['smtp_server', 'email_from', 'smtp_port', 'smtp_ssl', 'smtp_user', 'smtp_password']
-        cr.execute("""select """+','.join(data)+"""
-            from email_configuration
-            limit 1
-        """)
+        cr.execute("""select %s from email_configuration
+            limit 1""" % ','.join(data))  # not_a_user_entry
         res = cr.fetchone()
         if res:
             for i, key in enumerate(data):

=== modified file 'bin/addons/msf_profile/user_access_configurator.py'
--- bin/addons/msf_profile/user_access_configurator.py	2017-02-20 14:38:29 +0000
+++ bin/addons/msf_profile/user_access_configurator.py	2017-10-06 09:59:17 +0000
@@ -686,10 +686,10 @@
             models_to_clean = ['ir.model.access', 'ir.rule']
             for model in models_to_clean:
                 m_obj = self.pool.get(model)
-                cr.execute('''select m.id from '''+ m_obj._table+''' m
-                    left join ir_model_data d on d.res_id = m.id and d.model = %s
+                cr.execute('''select m.id from %s m
+                    left join ir_model_data d on d.res_id = m.id and d.model = %%s
                     where module not in ('sd', 'sync_client', 'sync_server', 'sync_common', 'sync_so', 'update_client', 'update_server', '')
-                ''', (model,))
+                ''' % m_obj._table, (model,))  # not_a_user_entry
                 ids_to_del = [x[0] for x in cr.fetchall()]
                 if ids_to_del:
                     m_obj.unlink(cr, 1, ids_to_del)

=== modified file 'bin/addons/msf_tools/msf_tools.py'
--- bin/addons/msf_tools/msf_tools.py	2017-06-08 07:14:54 +0000
+++ bin/addons/msf_tools/msf_tools.py	2017-10-06 09:59:17 +0000
@@ -221,7 +221,7 @@
         res_record = cr.fetchone()
         if res_record and res_record[0]:
             # drop existing constraint
-            tpl_drop_const = "alter table %s drop constraint %s" % sql_params
+            tpl_drop_const = "alter table %s drop constraint %s" % sql_params  # not_a_user_entry
             cr.execute(tpl_drop_const)
 
     def domain_get_field_index(self, domain, field_name):
@@ -424,7 +424,7 @@
                             previous_values = dest_obj.read(cr, uid, [item_data[i]['id']], [seq_field], context=context)
                             audit_obj.audit_log(cr, uid, to_trace, dest_obj, [item_data[i]['id']], 'write', previous_values, {item_data[i]['id']: {seq_field: start_num}}, context=context)
 
-                        cr.execute("update "+dest_obj._table+" set "+seq_field+"=%s where id=%s", (start_num, item_data[i]['id']))
+                        cr.execute("update "+dest_obj._table+" set "+seq_field+"=%s where id=%s", (start_num, item_data[i]['id']))  # not_a_user_entry
                         #dest_obj.write(cr, uid, [item_data[i]['id']], {seq_field: start_num}, context=context)
 
             # reset sequence to start_num + 1 all time, checking if needed would take much time
@@ -729,9 +729,8 @@
             parent_name = translation.name.split(',')[0]
 
             obj = self.pool.get(parent_name)
-            sql = "SELECT id FROM " + obj._table + \
-                  " WHERE id=" + str(translation.res_id)
-            cr.execute(sql)
+            sql = "SELECT id FROM " + obj._table + " WHERE id=%s"  # not_a_user_entry
+            cr.execute(sql, (translation.res_id,))
             res = cr.fetchall()
             if not res:
                 unlink_ids.append(translation.id)

=== modified file 'bin/addons/object_query/query.py'
--- bin/addons/object_query/query.py	2016-08-03 17:53:09 +0000
+++ bin/addons/object_query/query.py	2017-10-06 09:59:17 +0000
@@ -350,7 +350,7 @@
                 if to_del:
                     self.pool.get('object.query.selection_data').unlink(cr, uid, to_del)
             if obj.object_id:
-                cr.execute("update "+self._table+" set newquery='f'");
+                cr.execute("update "+self._table+" set newquery='f'");  # not_a_user_entry
         return True
 
     _constraints = [

=== modified file 'bin/addons/product/pricelist.py'
--- bin/addons/product/pricelist.py	2016-01-04 13:35:41 +0000
+++ bin/addons/product/pricelist.py	2017-10-06 09:59:17 +0000
@@ -257,7 +257,7 @@
                         'product_pricelist_version AS v, product_pricelist AS pl '
                     'WHERE (product_tmpl_id IS NULL OR product_tmpl_id = %s) '
                         'AND (product_id IS NULL OR product_id = %s) '
-                        'AND (' + categ_where + ' OR (categ_id IS NULL)) '
+                        'AND (' + categ_where + ' OR (categ_id IS NULL)) '  # not_a_user_entry
                         'AND price_version_id = %s '
                         'AND (min_quantity IS NULL OR min_quantity <= %s) '
                         'AND i.price_version_id = v.id AND v.pricelist_id = pl.id '
@@ -399,7 +399,7 @@
                     'product_pricelist_version AS v, product_pricelist AS pl '
                 'WHERE (product_tmpl_id IS NULL OR product_tmpl_id = %s) '
                     'AND (product_id IS NULL OR product_id = %s) '
-                    'AND (' + categ_where + ' OR (categ_id IS NULL)) '
+                    'AND (' + categ_where + ' OR (categ_id IS NULL)) '  # not_a_user_entry
                     'AND price_version_id = %s '
                     'AND (min_quantity IS NULL OR min_quantity <= %s) '
                     'AND i.price_version_id = v.id AND v.pricelist_id = pl.id '
@@ -517,7 +517,7 @@
 
             cursor.execute('SELECT id ' \
                     'FROM product_pricelist_version ' \
-                    'WHERE '+' and '.join(where) + (where and ' and ' or '')+
+                    'WHERE '+' and '.join(where) + (where and ' and ' or '')+  # not_a_user_entry
                         'pricelist_id = %s ' \
                         'AND active ' \
                         'AND id <> %s', (

=== modified file 'bin/addons/product_attributes/product_attributes.py'
--- bin/addons/product_attributes/product_attributes.py	2017-06-12 16:07:45 +0000
+++ bin/addons/product_attributes/product_attributes.py	2017-10-06 09:59:17 +0000
@@ -330,19 +330,19 @@
                             touched='[''%s'']'
                         WHERE model = 'product.product'
                         AND res_id IN (%s)
-        ''' % (new_column, ids_req))
+        ''' % (new_column, ids_req))  # not_a_user_entry
 
         # Make the migration
         if new_column == 'standard_ok':
-            request = 'UPDATE product_product SET standard_ok = \'True\' WHERE %s = True' % moved_column
+            request = 'UPDATE product_product SET standard_ok = \'True\' WHERE %s = True' % moved_column  # not_a_user_entry
             cr.execute(request)
 
         if new_column == 'dangerous_goods':
-            request = 'UPDATE product_product SET is_dg = True, dg_txt = \'X\', dangerous_goods = \'True\' WHERE %s = True' % moved_column
+            request = 'UPDATE product_product SET is_dg = True, dg_txt = \'X\', dangerous_goods = \'True\' WHERE %s = True' % moved_column  # not_a_user_entry
             cr.execute(request)
 
         if new_column == 'short_shelf_life':
-            request = 'UPDATE product_product SET is_ssl = True, ssl_txt = \'X\', short_shelf_life = \'True\' WHERE %s = True' % moved_column
+            request = 'UPDATE product_product SET is_ssl = True, ssl_txt = \'X\', short_shelf_life = \'True\' WHERE %s = True' % moved_column  # not_a_user_entry
             cr.execute(request)
 
         if new_column == 'controlled_substance':
@@ -351,7 +351,7 @@
                               controlled_substance = 'True',
                               is_cs = True,
                               cs_txt = 'X'
-                            WHERE %s = True OR narcotic = True''' % moved_column
+                            WHERE %s = True OR narcotic = True''' % moved_column  # not_a_user_entry
             cr.execute(request)
 
         return
@@ -1792,7 +1792,7 @@
         '''
         res = {}
         if default_code:
-            cr.execute("SELECT * FROM product_product pp where pp.default_code = '%s'" % default_code)
+            cr.execute("SELECT * FROM product_product pp where pp.default_code = %s", (default_code,))
             duplicate = cr.fetchall()
             if duplicate:
                 res.update({'warning': {'title': 'Warning', 'message':'The Code already exists'}})

=== modified file 'bin/addons/product_expiry/product_expiry.py'
--- bin/addons/product_expiry/product_expiry.py	2016-08-18 08:32:03 +0000
+++ bin/addons/product_expiry/product_expiry.py	2017-10-06 09:59:17 +0000
@@ -152,7 +152,7 @@
         # 1. Table stock_move
         sql_x = 'select lot.name, move.product_id, move.' + field_expiry_name + ' as life_date from ' + table_name + ' move, stock_production_lot lot, product_product prod where move.'
         sql_x = sql_x + field_id + ' = lot.id and move.product_id != lot.product_id  and move.product_id = prod.id and '
-        sql_x = sql_x + ' (prod.batch_management = \'t\' OR prod.perishable = \'t\') group by lot.name, move.product_id, move.' + field_expiry_name +'  order by lot.name;'
+        sql_x = sql_x + ' (prod.batch_management = \'t\' OR prod.perishable = \'t\') group by lot.name, move.product_id, move.' + field_expiry_name +'  order by lot.name;'  # not_a_user_entry
         
         cr.execute(sql_x)
         
@@ -180,7 +180,7 @@
                 batch_id = batch_id[0]
 
                 sql_up = 'update ' + table_name + ' set ' + field_id + '=' + str(batch_id) + ' where id in (select move.id from ' + table_name  
-                sql_up = sql_up + ' move, stock_production_lot lot where move.' + field_id + " = lot.id and lot.name= '" + batch_name + "' and move.product_id = " + str(prod_id) + " and move." + field_expiry_name + "='" + life_date + "');"
+                sql_up = sql_up + ' move, stock_production_lot lot where move.' + field_id + " = lot.id and lot.name= '" + batch_name + "' and move.product_id = " + str(prod_id) + " and move." + field_expiry_name + "='" + life_date + "');"  # not_a_user_entry
                 
                 cr.execute(sql_up)
                 self._logger.info("--- Step 3: Batch already created. Now assign all the ref lines of table %s with wrong batch references to the new batch: %s\n"%(table_name, batch_id))
@@ -214,7 +214,7 @@
                 self._logger.info("--- Step 3: Now assign all the ref lines of table %s with wrong batch references to the new batch: %s\n"%(table_name, batch_id))
                 if batch_id:
                     sql_up = 'update ' + table_name + ' set ' + field_id + ' = ' + str(batch_id) + ' where product_id=' + str(prod_id) + ' and ' + field_id + '=' + str(existing_batch.id)  
-                    sql_up = sql_up + " and " + field_expiry_name + "='" + life_date + "';"
+                    sql_up = sql_up + " and " + field_expiry_name + "='" + life_date + "';"  # not_a_user_entry
                     cr.execute(sql_up)
 
         self._logger.info("__________Finish the migration task on duplicate batch objects for table: %s\n", table_name)
@@ -337,7 +337,7 @@
             self.update_table(cr, uid, element[0] , element[1], wrong_id, lead_id, batch_name)
 
     def update_table(self, cr, uid, table_name, field_id, wrong_id, lead_id, batch_name):
-        cr.execute('select count(*) as amount from ' + table_name + ' where ' + field_id + ' = %s;' %(wrong_id,))
+        cr.execute('select count(*) as amount from ' + table_name + ' where ' + field_id + ' =%s', (wrong_id,))  # not_a_user_entry
         count = cr.fetchone()[0]
         if count > 0: # Only update the table if wrong bn exists
             self._logger.info("Table %s has %s batch objects (%s) and will be-mapped.\n" %(table_name, count, batch_name,))
@@ -353,8 +353,8 @@
                 del_sql_update = "DELETE FROM real_average_consumption_line WHERE prodlot_id = %s"
                 cr.execute(del_sql_update, (wrong_id,))
             else:
-                sql_update = "update " + table_name + " set " + field_id + "=" + str(lead_id) + " where " + field_id + "=" + str(wrong_id)
-                cr.execute(sql_update)
+                sql_update = "update " + table_name + " set " + field_id + "=%s" + " where " + field_id + "=%s"  # not_a_user_entry
+                cr.execute(sql_update, (lead_id, wrong_id))
         else:
             self._logger.info("Table %s has NO duplicate batch (%s).\n" %(table_name, batch_name,))
 

=== modified file 'bin/addons/register_accounting/account_analytic_line.py'
--- bin/addons/register_accounting/account_analytic_line.py	2017-04-05 13:57:20 +0000
+++ bin/addons/register_accounting/account_analytic_line.py	2017-10-06 09:59:17 +0000
@@ -66,7 +66,7 @@
             return True
         if isinstance(ids, (int, long)):
             ids = [ids]
-        sql = "UPDATE " + self._table + " SET partner_txt = %s WHERE id in %s"
+        sql = "UPDATE " + self._table + " SET partner_txt = %s WHERE id in %s"  # not_a_user_entry
         cr.execute(sql, (value or None, tuple(ids)))
         return True
 

=== modified file 'bin/addons/register_accounting/register_tools.py'
--- bin/addons/register_accounting/register_tools.py	2017-09-01 13:58:46 +0000
+++ bin/addons/register_accounting/register_tools.py	2017-10-06 09:59:17 +0000
@@ -65,7 +65,7 @@
         if value:
             fields = value.split(",")
             element = fields[0]
-        sql = "UPDATE %s SET " % self._table
+        sql = "UPDATE %s SET " % self._table  # not_a_user_entry
         emp_val = 'Null'
         par_val = 'Null'
         tra_val = 'Null'
@@ -80,7 +80,7 @@
         cr.execute(sql)
     # Delete values for Third Parties if no value given
     elif name == 'partner_type' and not value:
-        cr.execute("UPDATE %s SET employee_id = Null, partner_id = Null, transfer_journal_id = Null WHERE id = %s" % (self._table, obj_id))
+        cr.execute("UPDATE %s SET employee_id = Null, partner_id = Null, transfer_journal_id = Null WHERE id = %%s" % self._table, (obj_id,))  # not_a_user_entry
     return True
 
 

=== modified file 'bin/addons/register_accounting/report/report_open_advances.py'
--- bin/addons/register_accounting/report/report_open_advances.py	2014-03-07 11:05:37 +0000
+++ bin/addons/register_accounting/report/report_open_advances.py	2017-10-06 09:59:17 +0000
@@ -61,10 +61,10 @@
                 account.type_for_register = 'advance' AND
                 line.state = 'valid' AND
                 line.reconcile_id IS NULL AND
-                line.date <= '%s'
+                line.date <= %s
             ORDER BY account_name, booking_currency.name, line.partner_txt, line.date
-        """ % (time.strftime('%Y-%m-%d'))
-        cr.execute(sql_open_advances)
+        """
+        cr.execute(sql_open_advances, (time.strftime('%Y-%m-%d'),))
         res = header + cr.fetchall()
 
         b = StringIO.StringIO()

=== modified file 'bin/addons/register_accounting/wizard/wizard_liquidity_position.py'
--- bin/addons/register_accounting/wizard/wizard_liquidity_position.py	2016-07-20 13:59:13 +0000
+++ bin/addons/register_accounting/wizard/wizard_liquidity_position.py	2017-10-06 09:59:17 +0000
@@ -64,8 +64,8 @@
             LEFT JOIN account_journal aj ON abs.journal_id = aj.id
             WHERE aj.type != 'cheque'
             AND abs.state != 'draft'
-            AND abs.period_id = """ + str(context['period_id'])
-        cr.execute(sql_register_ids)
+            AND abs.period_id = %s"""
+        cr.execute(sql_register_ids, (str(context['period_id']),))
 
         if not cr.fetchall():
             # No registers found

=== modified file 'bin/addons/res_currency_functional/account_move_compute_currency.py'
--- bin/addons/res_currency_functional/account_move_compute_currency.py	2016-11-17 08:46:41 +0000
+++ bin/addons/res_currency_functional/account_move_compute_currency.py	2017-10-06 09:59:17 +0000
@@ -76,7 +76,7 @@
         for arg in args:
             if args[0] and args[0][1] and args[0][1] in ['in', '='] and args[0][2]:
                 # create SQL request
-                sql = sql_base + ' in %s\nGROUP BY ml.id'
+                sql = sql_base + ' in %s\nGROUP BY ml.id'  # not_a_user_entry
                 second = args[0][2]
                 # execute it and fetch result
                 if isinstance(second, (int, long)):

=== modified file 'bin/addons/sale/sale.py'
--- bin/addons/sale/sale.py	2017-08-03 15:16:40 +0000
+++ bin/addons/sale/sale.py	2017-10-06 09:59:17 +0000
@@ -171,7 +171,7 @@
 
         cursor.execute('SELECT rel.order_id ' \
                        'FROM sale_order_invoice_rel AS rel, account_invoice AS inv '+ sale_clause + \
-                       'WHERE rel.invoice_id = inv.id ' + clause)
+                       'WHERE rel.invoice_id = inv.id ' + clause)  # not_a_user_entry
         res = cursor.fetchall()
         if no_invoiced:
             cursor.execute('SELECT sale.id ' \

=== modified file 'bin/addons/sale_override/sale.py'
--- bin/addons/sale_override/sale.py	2017-09-21 12:57:16 +0000
+++ bin/addons/sale_override/sale.py	2017-10-06 09:59:17 +0000
@@ -257,7 +257,7 @@
                     slsdr.document_id IN %%s
                     %s
                 GROUP BY sol.type
-            ''' % where_sql
+            ''' % where_sql  # not_a_user_entry
             cr.execute(sql, where_params)
             res = cr.dictfetchall()
 
@@ -685,7 +685,7 @@
 
         cursor.execute('SELECT rel.order_id ' \
                        'FROM sale_order_invoice_rel AS rel, account_invoice AS inv, sale_order AS sale, res_partner AS part ' + sale_clause + \
-                       'WHERE rel.invoice_id = inv.id AND rel.order_id = sale.id AND sale.partner_id = part.id ' + clause)
+                       'WHERE rel.invoice_id = inv.id AND rel.order_id = sale.id AND sale.partner_id = part.id ' + clause)  # not_a_user_entry
         res = cursor.fetchall()
         if no_invoiced:
             cursor.execute('SELECT sale.id ' \
@@ -1091,7 +1091,7 @@
                             LEFT JOIN product_product p ON l.product_id = p.id
                             LEFT JOIN product_template t ON p.product_tmpl_id = t.id
                             LEFT JOIN sale_order fo ON l.order_id = fo.id
-                          WHERE (t.type != 'service_recep' %s) AND fo.id in %%s LIMIT 1''' % transport_cat,
+                          WHERE (t.type != 'service_recep' %s) AND fo.id in %%s LIMIT 1''' % transport_cat,  # not_a_user_entry
                        (tuple(ids),))
             res = cr.fetchall()
 

=== modified file 'bin/addons/specific_rules/specific_rules.py'
--- bin/addons/specific_rules/specific_rules.py	2017-08-23 14:10:02 +0000
+++ bin/addons/specific_rules/specific_rules.py	2017-10-06 09:59:17 +0000
@@ -1093,7 +1093,7 @@
                     stock_report_prodlots_virtual
                 where
                     location_id IN %s group by prodlot_id
-                having  sum(qty) '''+ str(args[0][1]) + str(args[0][2]),(tuple(locations),))
+                having  sum(qty) '''+ str(args[0][1]) + str(args[0][2]),(tuple(locations),))  # not_a_user_entry
             res = cr.fetchall()
             ids = [('id', 'in', map(lambda x: x[0], res))]
         return ids
@@ -1600,7 +1600,7 @@
                 l.inventory_id in %%s
             GROUP BY l.product_id, l.location_id, l.%s, l.expiry_date
             HAVING count(l.id) > 1
-            ORDER BY count(l.id) DESC""" % (
+            ORDER BY count(l.id) DESC""" % (  # not_a_user_entry
             self._name.replace('.', '_'),
             self._name == 'stock.inventory' and 'prod_lot_id' or 'prodlot_name',
         )

=== modified file 'bin/addons/specific_rules/unconsistent_stock_report.py'
--- bin/addons/specific_rules/unconsistent_stock_report.py	2016-02-05 09:13:42 +0000
+++ bin/addons/specific_rules/unconsistent_stock_report.py	2017-10-06 09:59:17 +0000
@@ -88,7 +88,7 @@
                 %s
             GROUP BY
                 srp.prodlot_id, srp.location_id, srp.product_id, spl.life_date
-        ''' % extra_where
+        ''' % extra_where  # not_a_user_entry
         cr.execute(request, (bm, perishable))
 
         for r in cr.dictfetchall():
@@ -198,7 +198,7 @@
               AND
                 pp.perishable = %%s
                 %s
-        ''' % extra_where
+        ''' % extra_where  # not_a_user_entry
         cr.execute(request, (bm, perishable))
 
         for r in cr.dictfetchall():
@@ -264,7 +264,7 @@
                 )
             GROUP BY
                 sil.product_id, sil.prod_lot_id, sil.expiry_date, sil.location_id, document_number
-        ''' % (name, model, model)
+        ''' % (name, model, model)  # not_a_user_entry
         cr.execute(request)
 
         for r in cr.dictfetchall():

=== modified file 'bin/addons/stock/product.py'
--- bin/addons/stock/product.py	2016-08-26 14:25:42 +0000
+++ bin/addons/stock/product.py	2017-10-06 09:59:17 +0000
@@ -253,27 +253,25 @@
         date_str = date_str and ' AND %s '% date_str or ''
         if 'in' in what:
             # all moves from a location out of the set to a location in the set
-            cr.execute(
-                'select sum(product_qty), product_id, product_uom '\
-                'from stock_move '\
-                'where location_id NOT IN %s '\
-                'and location_dest_id IN %s '\
-                'and product_id IN %s '\
-                '' + prodlot_id_str + ' '\
-                'and state IN %s ' + date_str +' '\
-                'group by product_id,product_uom',tuple(where))
+            cr.execute("""
+                select sum(product_qty), product_id, product_uom
+                from stock_move
+                where location_id NOT IN %%s
+                and location_dest_id IN %%s
+                and product_id IN %%s %s
+                and state in %%s %s
+                group by product_id,product_uom""" % (prodlot_id_str, date_str),tuple(where))  # not_a_user_entry
             results = cr.fetchall()
         if 'out' in what:
             # all moves from a location in the set to a location out of the set
-            cr.execute(
-                'select sum(product_qty), product_id, product_uom '\
-                'from stock_move '\
-                'where location_id IN %s '\
-                'and location_dest_id NOT IN %s '\
-                'and product_id  IN %s '\
-                '' + prodlot_id_str + ' '\
-                'and state in %s ' + date_str + ' '\
-                'group by product_id,product_uom',tuple(where))
+            cr.execute("""
+                select sum(product_qty), product_id, product_uom
+                from stock_move
+                where location_id IN %%s
+                and location_dest_id NOT IN %%s
+                and product_id IN %%s %s
+                and state in %%s %s
+                group by product_id,product_uom""" % (prodlot_id_str, date_str),tuple(where))  # not_a_user_entry
             results2 = cr.fetchall()
 
         if results or results2:

=== modified file 'bin/addons/stock/stock.py'
--- bin/addons/stock/stock.py	2017-08-23 14:10:02 +0000
+++ bin/addons/stock/stock.py	2017-10-06 09:59:17 +0000
@@ -560,13 +560,14 @@
             ids = [ids]
         for pick in self.read(cr, uid, ids,['max_date'], context=context):
             sql_str = """update stock_move set
-                    date='%s'
+                    date=%s
                 where
-                    picking_id=%d """ % (value, pick['id'])
-
+                    picking_id=%s"""
+            sql_params = (value, pick['id'])
             if pick['max_date']:
-                sql_str += " and (date='" + pick['max_date'] + "' or date>'" + value + "')"
-            cr.execute(sql_str)
+                sql_str += " and (date=%s or date>%s)"
+                sql_params.extend((pick['max_date'], value))
+            cr.execute(sql_str, sql_params)
         return True
 
     def _set_minimum_date(self, cr, uid, ids, name, value, arg, context=None):
@@ -582,12 +583,14 @@
             ids = [ids]
         for pick in self.read(cr, uid, ids, ['min_date'], context=context):
             sql_str = """update stock_move set
-                    date='%s'
+                    date=%s
                 where
-                    picking_id=%s """ % (value, pick['id'])
+                    picking_id=%s"""
+            sql_params = (value, pick['id'])
             if pick['min_date']:
-                sql_str += " and (date='" + pick['min_date'] + "' or date<'" + value + "')"
-            cr.execute(sql_str)
+                sql_str += " and (date=%s or date<%s)"
+                sql_params.extend((pick['min_date'], value))
+            cr.execute(sql_str, sql_params)
         return True
 
     def get_min_max_date(self, cr, uid, ids, field_name, arg, context=None):
@@ -1656,7 +1659,7 @@
                     stock_report_prodlots
                 where
                     location_id IN %s group by prodlot_id
-                having  sum(qty) '''+ str(args[0][1]) + str(args[0][2]),(tuple(locations),))
+                having  sum(qty) '''+ str(args[0][1]) + str(args[0][2]),(tuple(locations),))  # not_a_user_entry
             res = cr.fetchall()
             ids = [('id', 'in', map(lambda x: x[0], res))]
         return ids

=== modified file 'bin/addons/supplier_catalogue/supplier_catalogue.py'
--- bin/addons/supplier_catalogue/supplier_catalogue.py	2017-08-23 21:01:21 +0000
+++ bin/addons/supplier_catalogue/supplier_catalogue.py	2017-10-06 09:59:17 +0000
@@ -279,7 +279,7 @@
                     # should be updated accordingly (that could be long operation)
                     cr.execute('''SELECT partner_info_id
                     FROM supplier_catalogue_line
-                    WHERE catalogue_id = %s ''' % (ids[0]))
+                    WHERE catalogue_id = %s ''', (ids[0],))
                     pricelist_ids = [x[0] for x in cr.fetchall() if x[0]]
                     price_obj.write(cr, uid, pricelist_ids, new_price_vals, context=context)
 
@@ -360,13 +360,13 @@
         cr.execute('''delete from pricelist_partnerinfo
                       where id in (select partner_info_id
                                     from supplier_catalogue_line
-                                    where catalogue_id = %s)''' % (ids[0]))
+                                    where catalogue_id = %s)''', (ids[0],))
         cr.execute('''delete from product_supplierinfo
                         where id in (select supplier_info_id
                                     from supplier_catalogue_line
                                      where catalogue_id = %s)
                         and id not in (select suppinfo_id from
-                                    pricelist_partnerinfo ) ''' % (ids[0]))
+                                    pricelist_partnerinfo ) ''', (ids[0],))
 
 
         return True
@@ -1013,13 +1013,14 @@
                 cr.execute('''delete from pricelist_partnerinfo
                               where id in (select partner_info_id
                                           from supplier_catalogue_line
-                                          where catalogue_id = %s)''' % (ids[0]))
+                                          where catalogue_id = %s)''', (ids[0],))
                 cr.execute('''delete from product_supplierinfo
                               where id in (select supplier_info_id
                                           from supplier_catalogue_line
                                           where catalogue_id = %s)
                               and id not in (select suppinfo_id from
-                                            pricelist_partnerinfo ) ''' % (ids[0]))
+                                            pricelist_partnerinfo ) ''',
+                                            (ids[0],))
 
             res = super(supplier_catalogue_line, self).write(cr, uid, [line.id], new_vals, context=context)
 

=== modified file 'bin/addons/sync_client/ir_model_data.py'
--- bin/addons/sync_client/ir_model_data.py	2016-11-28 16:19:14 +0000
+++ bin/addons/sync_client/ir_model_data.py	2017-10-06 09:59:17 +0000
@@ -70,8 +70,7 @@
     FROM ir_model_data
     LEFT JOIN %(table)s ON %(table)s.id = ir_model_data.res_id
         WHERE ir_model_data.model = %%s AND ir_model_data.res_id IN %%s AND ir_model_data.id IN %%s
-        GROUP BY ir_model_data.model, ir_model_data.res_id HAVING COUNT(%(table)s.id) = 0""" \
-                % {'table':self.pool.get(model)._table}, [model, tuple(res_ids), tuple(ids)])
+        GROUP BY ir_model_data.model, ir_model_data.res_id HAVING COUNT(%(table)s.id) = 0""" % {'table':self.pool.get(model)._table}, [model, tuple(res_ids), tuple(ids)])  # not_a_user_entry
             for data_ids, exists in cr.fetchall():
                 res.update(dict((id, not exists) for id in data_ids))
         return res
@@ -125,7 +124,7 @@
                 FROM %s r
                     LEFT JOIN ir_model_data data ON data.module = 'sd' AND
                         data.model = %%s AND r.id = data.res_id
-                WHERE data.res_id IS NULL;""" % obj._table, [obj._name])
+                WHERE data.res_id IS NULL;""" % obj._table, [obj._name])  # not_a_user_entry
             record_ids = map(lambda x: x[0], cr.fetchall())
 
             # if we have some records that doesn't have an sdref
@@ -192,7 +191,7 @@
 DELETE FROM ir_model_data WHERE id IN %s""", [tuple(to_delete)])
                 for id, rec in to_write:
                     cr.execute("""\
-UPDATE ir_model_data SET """+", ".join("%s = %%s" % k for k in rec.keys())+""" WHERE id = %s""", rec.values() + [id])
+UPDATE ir_model_data SET """+", ".join("%s = %%s" % k for k in rec.keys())+""" WHERE id = %s""", rec.values() + [id])  # not_a_user_entry
                 cr.execute("""CREATE UNIQUE INDEX unique_sdref_constraint ON ir_model_data (model, res_id) WHERE module = 'sd'""")
                 cr.commit()
                 self._logger.info("%d sdref(s) deleted, %d kept." % (len(to_delete), len(to_write)))

=== modified file 'bin/addons/sync_client/log_sale_purchase.py'
--- bin/addons/sync_client/log_sale_purchase.py	2014-01-14 08:37:50 +0000
+++ bin/addons/sync_client/log_sale_purchase.py	2017-10-06 09:59:17 +0000
@@ -53,13 +53,12 @@
 
     def _get_model_id_from_document(self, cr, uid, ids, field, args, context=None):
         self.read(cr, uid, ids, ['model'], context=context)
-        cr.execute("""\
+        cr.execute("""
             SELECT log.id, m.id
             FROM %s log
             LEFT JOIN ir_model m
             ON log.model = m.model
-            WHERE log.id IN %%s;""" \
-            % (self._table,), [tuple(ids)])
+            WHERE log.id IN %%s;""" % (self._table,), [tuple(ids)])  # not_a_user_entry
         return dict(cr.fetchall())
 
     @check

=== modified file 'bin/addons/sync_client/orm.py'
--- bin/addons/sync_client/orm.py	2017-09-28 08:23:33 +0000
+++ bin/addons/sync_client/orm.py	2017-10-06 09:59:17 +0000
@@ -122,8 +122,7 @@
     WHERE module = 'sd' AND
           model = %s AND
           """+add_sql+"""
-          ("""+field+""" < last_modification OR """+field+""" IS NULL)
-          """,
+          ("""+field+""" < last_modification OR """+field+""" IS NULL)""",  # not_a_user_entry
                        sql_params)
             result = [row[0] for row in cr.fetchall()]
         else:
@@ -134,8 +133,7 @@
     WHERE module = 'sd' AND
           model = %s AND
           """+add_sql+"""
-          ("""+field+""" < last_modification OR """+field+""" IS NULL) 
-          """,
+          ("""+field+""" < last_modification OR """+field+""" IS NULL)""",  # not_a_user_entry
                        sql_params)
             result = [row[0] for row in cr.fetchall()
                       if row[1] is None \
@@ -439,11 +437,10 @@
         field, real_field = ('id' if field == 'is_deleted' else field), field
         if self._name == "ir.model.data":
             cr.execute("""\
-SELECT name, %s FROM ir_model_data WHERE module = 'sd' AND name IN %%s""" % field, [sdrefs])
+SELECT name, %s FROM ir_model_data WHERE module = 'sd' AND name IN %%s""" % field, [sdrefs])  # not_a_user_entry
         else:
             cr.execute("""\
-SELECT name, %s FROM ir_model_data WHERE module = 'sd' AND model = %%s AND name IN %%s""" \
-% field, [self._name,sdrefs])
+SELECT name, %s FROM ir_model_data WHERE module = 'sd' AND model = %%s AND name IN %%s""" % field, [self._name,sdrefs])  # not_a_user_entry
         try:
             result = RejectingDict(cr.fetchall())
         except DuplicateKey, e:
@@ -666,7 +663,7 @@
         cr.execute('''
         select d.res_id from ir_model_data d
         left join '''+self._table+''' t on t.id = d.res_id and d.model=%(model)s
-        where t.id is null and d.model=%(model)s'''+sql_add, sql_params)
+        where t.id is null and d.model=%(model)s'''+sql_add, sql_params)  # not_a_user_entry
         return [x[0] for x in cr.fetchall()]
 
     def search_ext(self, cr, user, args, offset=0, limit=None, order=None, context=None, count=False):

=== modified file 'bin/addons/sync_client/special_handling.py'
--- bin/addons/sync_client/special_handling.py	2017-04-07 12:49:38 +0000
+++ bin/addons/sync_client/special_handling.py	2017-10-06 09:59:17 +0000
@@ -252,7 +252,7 @@
                 value_to_write.append(value[i])
 
         value_to_write.append(obj_id)
-        cr.execute('UPDATE '+pool_obj._table+' SET ('+','.join(fields)+') = ('+','.join(to_replace)+') WHERE id=%s', tuple(value_to_write))
+        cr.execute('UPDATE '+pool_obj._table+' SET ('+','.join(fields)+') = ('+','.join(to_replace)+') WHERE id=%s', tuple(value_to_write))  # not_a_user_entry
         return True
 
 

=== modified file 'bin/addons/sync_client/sync_client.py'
--- bin/addons/sync_client/sync_client.py	2017-09-25 17:32:34 +0000
+++ bin/addons/sync_client/sync_client.py	2017-10-06 09:59:17 +0000
@@ -1258,15 +1258,15 @@
 
         # delete sync_client_update_received older than 6 month
         cr.execute("""DELETE FROM sync_client_update_received
-        WHERE create_date < now() - interval '%d month' AND
-        execution_date IS NOT NULL AND run='t'""" % nb_month_to_clean)
+        WHERE create_date < now() - interval '%s month' AND
+        execution_date IS NOT NULL AND run='t'""", (nb_month_to_clean,))
         deleted_update_received = cr.rowcount
         self._logger.info('clean_updates method has deleted %d sync_client_update_received' % deleted_update_received)
 
         # delete sync_client_update_to_send older than 6 month
         cr.execute("""DELETE FROM sync_client_update_to_send
-        WHERE create_date < now() - interval '%d month' AND
-        sent_date IS NOT NULL AND sent='t'""" % nb_month_to_clean)
+        WHERE create_date < now() - interval '%s month' AND
+        sent_date IS NOT NULL AND sent='t'""", (nb_month_to_clean,))
         deleted_update_to_send = cr.rowcount
         self._logger.info('clean_updates method has deleted %d sync_client_update_to_send' % deleted_update_to_send)
 

=== modified file 'bin/addons/sync_common/migration_scripts.py'
--- bin/addons/sync_common/migration_scripts.py	2013-06-10 14:59:51 +0000
+++ bin/addons/sync_common/migration_scripts.py	2017-10-06 09:59:17 +0000
@@ -36,7 +36,7 @@
     WHERE %(table)s.%(column)s = %(rel_table)s.id;
 ALTER TABLE %(table)s DROP COLUMN %(column)s;
 ALTER TABLE %(table)s RENAME COLUMN new_%(column)s TO %(column)s;
-COMMIT;""" % format_keys)
+COMMIT;""" % format_keys)  # not_a_user_entry
             return fn(self, cr, context=context)
         return wrapper
     return decorator
@@ -53,7 +53,7 @@
         column_sdref_exists = bool( cr.fetchone() )
         result = fn(self, cr, context=context)
         if not column_sdref_exists:
-            cr.execute("SELECT COUNT(*) FROM %s" % self._table)
+            cr.execute("SELECT COUNT(*) FROM %s" % self._table)  # not_a_user_entry
             count = cr.fetchone()[0]
             if count > 0:
                 cr.commit()
@@ -68,7 +68,7 @@
                         data = dict(zip(eval(fields), eval(values)))
                         assert 'id' in data, "Cannot find column 'id' on model=%s id=%d" % (self._name, id)
                         sdref = xmlid_to_sdref(data['id'])
-                        cr.execute("UPDATE %s SET sdref = %%s WHERE id = %%s" % self._table, [sdref, id])
+                        cr.execute("UPDATE %s SET sdref = %%s WHERE id = %%s" % self._table, [sdref, id])  # not_a_user_entry
                     except AssertionError, e:
                         _logger.error("Cannot find SD ref on model=%s id=%d: %s" % (self._name, id, e.message))
                         cr.execute("ROLLBACK TO SAVEPOINT make_sdref")
@@ -96,14 +96,14 @@
 FROM information_schema.columns c1
     LEFT JOIN information_schema.columns c2
     ON c2.table_name = c1.table_name AND c2.column_name = 'sequence_number'
-WHERE c1.table_name = '%s' AND c1.column_name = 'sequence' AND c2.column_name IS NULL;""" % self._table)
+WHERE c1.table_name = %s AND c1.column_name = 'sequence' AND c2.column_name IS NULL;""", (self._table,))  # not_a_user_entry
         if cr.fetchone():
             _logger.info("Replacing column sequence by sequence_number for table %s..." % self._table)
             cr.execute("""\
 ALTER TABLE %(table)s ADD COLUMN "sequence_number" INTEGER;
 UPDATE %(table)s SET sequence_number = sequence;
 ALTER TABLE %(table)s DROP COLUMN "sequence";
-""" % {'table':self._table})
+""" % {'table':self._table})  # not_a_user_entry
         return fn(self, cr, context=context)
     return wrapper
 

=== modified file 'bin/addons/sync_remote_warehouse/orm.py'
--- bin/addons/sync_remote_warehouse/orm.py	2015-11-23 21:48:33 +0000
+++ bin/addons/sync_remote_warehouse/orm.py	2017-10-06 09:59:17 +0000
@@ -52,10 +52,10 @@
             SELECT res_id
                 FROM ir_model_data
                 WHERE module = 'sd' AND
-                      model = %%s AND
-                      (last_modification > '%(clone_date)s' OR sync_date > '%(clone_date)s' OR (last_modification is null and sync_date is null)) 
+                      model = %s AND
+                      (last_modification > %s OR sync_date > %s OR (last_modification is null and sync_date is null))
                       AND
-                      (usb_sync_date < last_modification OR usb_sync_date < sync_date OR usb_sync_date IS NULL)""" % {'clone_date' : clone_date},[self._name])
+                      (usb_sync_date < last_modification OR usb_sync_date < sync_date OR usb_sync_date IS NULL)""", (self._name, clone_date, clone_date))
 
         return [row[0] for row in cr.fetchall()]
 

=== modified file 'bin/addons/sync_remote_warehouse/wizard/setup_remote_warehouse.py'
--- bin/addons/sync_remote_warehouse/wizard/setup_remote_warehouse.py	2015-11-17 08:55:49 +0000
+++ bin/addons/sync_remote_warehouse/wizard/setup_remote_warehouse.py	2017-10-06 09:59:17 +0000
@@ -117,19 +117,19 @@
                 temp = 'ir_sequence_%03d' % seq['id']
                 if suffix == '-RW':
                     # US-27: Reset the sequence for the RW instance
-                    cr.execute("SELECT 0 FROM pg_class where relname = '%s'" % temp)
+                    cr.execute("SELECT 0 FROM pg_class where relname = '%s'" % temp)  # not_a_user_entry
                     res = cr.dictfetchone()
                     if res:
-                        cr.execute("select last_value from %s" % temp)
+                        cr.execute("select last_value from %s" % temp)  # not_a_user_entry
                         res = cr.dictfetchone()
                         if res:
                             dict_seq_values[temp] = res['last_value']
-                        cr.execute("ALTER SEQUENCE " + temp +" RESTART WITH " + str(1))
+                        cr.execute("ALTER SEQUENCE " + temp +" RESTART WITH " + str(1))  # not_a_user_entry
                 else:
                     # US-27: Revert all the sequence that has been set before
                     value = dict_seq_values.get(temp, False)
                     if value:
-                        cr.execute("ALTER SEQUENCE " + temp +" RESTART WITH " + str(value + 1))
+                        cr.execute("ALTER SEQUENCE " + temp +" RESTART WITH " + str(value + 1))  # not_a_user_entry
                 new_suffix = '%s%s' % (old_suffix, suffix)
                 seq_obj.write(cr, uid, [seq.id], {'suffix': new_suffix}, context=context)
 

=== modified file 'bin/addons/sync_server/sync_server.py'
--- bin/addons/sync_server/sync_server.py	2017-09-25 16:18:24 +0000
+++ bin/addons/sync_server/sync_server.py	2017-10-06 09:59:17 +0000
@@ -609,7 +609,7 @@
             order = order.replace('last_dateactivity', 'datetime')
             limit_str = init_limit and ' limit %d' % init_limit or ''
             offset_str = init_offset and ' offset %d' % init_offset or ''
-            cr.execute('select entity_id from sync_server_entity_activity where entity_id in %s order by ' + order + limit_str + offset_str, (tuple(ids),))
+            cr.execute('select entity_id from sync_server_entity_activity where entity_id in %s order by ' + order + limit_str + offset_str, (tuple(ids),))  # not_a_user_entry
             return [x[0] for x in cr.fetchall()]
         return ids
 

=== modified file 'bin/addons/sync_server/update.py'
--- bin/addons/sync_server/update.py	2017-10-02 08:00:42 +0000
+++ bin/addons/sync_server/update.py	2017-10-06 09:59:17 +0000
@@ -105,7 +105,7 @@
         for to_del in foreign_key_to_delete:
             cr.execute("SELECT conname FROM pg_constraint WHERE conname = %s", (to_del, ))
             if cr.fetchone():
-                cr.execute("ALTER table sync_server_entity_rel DROP CONSTRAINT %s" % (to_del,))
+                cr.execute("ALTER table sync_server_entity_rel DROP CONSTRAINT %s" % (to_del,))  # not_a_user_entry
 
     def init(self, cr):
         cr.execute("""\
@@ -131,7 +131,7 @@
   ALTER COLUMN "id" SET NOT NULL;
 ALTER TABLE "public"."%(table)s" ADD UNIQUE ("id");
 ALTER TABLE "public"."%(table)s" DROP CONSTRAINT "%(table)s_id_key" RESTRICT;
-ALTER TABLE "public"."%(table)s" ADD PRIMARY KEY ("id");""" % {'table':self._table})
+ALTER TABLE "public"."%(table)s" ADD PRIMARY KEY ("id");""" % {'table':self._table})  # not_a_user_entry
 
 
 class update(osv.osv):
@@ -203,10 +203,9 @@
                    [(puller_ids_rel._table, self._table)]);
         existing_tables = [row[0] for row in cr.fetchall()]
         if puller_ids_rel._table in existing_tables:
-            cr.execute("""DELETE FROM %s WHERE update_id IN (SELECT id FROM %s WHERE rule_id IS NULL)""" \
-                       % (puller_ids_rel._table, self._table))
+            cr.execute("""DELETE FROM %s WHERE update_id IN (SELECT id FROM %s WHERE rule_id IS NULL)""" % (puller_ids_rel._table, self._table))  # not_a_user_entry
         if self._table in existing_tables:
-            cr.execute("""DELETE FROM %s WHERE rule_id IS NULL""" % self._table)
+            cr.execute("""DELETE FROM %s WHERE rule_id IS NULL""" % self._table)  # not_a_user_entry
         super(update, self)._auto_init(cr, context=context)
         cr.execute("SELECT indexname FROM pg_indexes WHERE indexname = 'sync_server_update_sequence_id_index'")
         if not cr.fetchone():
@@ -509,7 +508,7 @@
 
         if not recover and init_sync:
             # first sync get only master data
-            cr.execute("select id from sync_server_sync_rule where id in (" + ','.join(map(str, rules)) + ") and master_data='t'");
+            cr.execute("select id from sync_server_sync_rule where id in (" + ','.join(map(str, rules)) + ") and master_data='t'")  # not_a_user_entry
             rules = [x[0] for x in cr.fetchall()]
 
         base_query = " ".join(("""SELECT "sync_server_update".id FROM "sync_server_update" INNER JOIN sync_server_sync_rule ON sync_server_sync_rule.id = rule_id WHERE""",
@@ -547,8 +546,7 @@
         self._logger.info("::::::::[%s] Data pull get package:: init sync = %s, last_seq = %s, max_seq = %s, offset = %s, max_size = %s" % (entity.name, init_sync, last_seq, max_seq, '/'.join(map(str, offset)), max_size))
 
         while not ids or packet_size < max_size:
-            query = base_query % (offset[0], offset[1], max_size)
-            cr.execute(query)
+            cr.execute(base_query, (offset[0], offset[1], max_size))
             ids = map(lambda x:x[0], cr.fetchall())
             if not ids:
                 break

=== modified file 'bin/addons/sync_so/so_po_common.py'
--- bin/addons/sync_so/so_po_common.py	2017-08-03 15:16:40 +0000
+++ bin/addons/sync_so/so_po_common.py	2017-10-06 09:59:17 +0000
@@ -157,7 +157,7 @@
         seq_tools = self.pool.get('sequence.tools')
 
         # Make sure that even if the FO/PO has no line, then the default value is 1
-        cr.execute("select max(line_number) from " + order_line_object + " where order_id = " + str(order_id))
+        cr.execute("select max(line_number) from %s where order_id = %%s" % order_line_object, (str(order_id),))  # not_a_user_entry
         for x in cr.fetchall():
             # For the FO without any line
             val = 1

=== modified file 'bin/addons/sync_so/specific_xml_id.py'
--- bin/addons/sync_so/specific_xml_id.py	2017-07-31 09:56:56 +0000
+++ bin/addons/sync_so/specific_xml_id.py	2017-10-06 09:59:17 +0000
@@ -241,17 +241,17 @@
             if isinstance(ids, (long, int)):
                 ids = [ids]
             res = dict.fromkeys(ids, False)
-            for id in ids:
-                cr.execute("select instance_id from account_target_costcenter where cost_center_id = %s" % (id))
+            for account_id in ids:
+                cr.execute("select instance_id from account_target_costcenter where cost_center_id = %s", (account_id,))
                 instance_ids = [x[0] for x in cr.fetchall()]
                 if len(instance_ids) > 0:
                     res_temp = []
                     for instance_id in instance_ids:
-                        cr.execute("select instance from msf_instance where id = %s and state = 'active'" % (instance_id))
+                        cr.execute("select instance from msf_instance where id = %s and state = 'active'", (instance_id,))
                         result = cr.fetchone()
                         if result:
                             res_temp.append(result[0])
-                    res[id] = res_temp
+                    res[account_id] = res_temp
             return res
 
         # UFTP-2: Get the children of the given instance and create manually sync updates for them, only when it is Coordo

=== modified file 'bin/addons/tender_flow/tender_flow.py'
--- bin/addons/tender_flow/tender_flow.py	2016-12-06 13:41:44 +0000
+++ bin/addons/tender_flow/tender_flow.py	2017-10-06 09:59:17 +0000
@@ -264,8 +264,7 @@
                             LEFT JOIN product_product p ON l.product_id = p.id
                             LEFT JOIN product_template pt ON p.product_tmpl_id = pt.id
                             LEFT JOIN tender t ON l.tender_id = t.id
-                          WHERE (pt.type != 'service_recep' %s) AND t.id in %%s LIMIT 1''' % transport_cat,
-                       (tuple(ids),))
+                          WHERE (pt.type != 'service_recep' %s) AND t.id in %%s LIMIT 1''' % transport_cat, (tuple(ids),))  # not_a_user_entry
             res = cr.fetchall()
 
         if res:

=== modified file 'bin/addons/update_client/version.py'
--- bin/addons/update_client/version.py	2016-04-25 15:54:40 +0000
+++ bin/addons/update_client/version.py	2017-10-06 09:59:17 +0000
@@ -33,8 +33,7 @@
     
     def _patch_needs_to_be_downloaded(self, cr, uid, ids, name, args, context=None):
         cr.execute("""\
-            SELECT id, patch IS NULL FROM %s WHERE id IN %%s""" % \
-            self._table, [tuple(ids)])
+            SELECT id, patch IS NULL FROM %s WHERE id IN %%s""" % self._table, [tuple(ids)])  # not_a_user_entry
         return dict(cr.fetchall())
 
     _columns = {

=== modified file 'bin/osv/expression.py'
--- bin/osv/expression.py	2017-05-18 13:47:43 +0000
+++ bin/osv/expression.py	2017-10-06 09:59:17 +0000
@@ -48,20 +48,19 @@
         res = []
         if ids:
             if op in ['<','>','>=','<=']:
-                cr.execute('SELECT "%s"'    \
-                           '  FROM "%s"'    \
-                           ' WHERE "%s" %s %%s' % (s, f, w, op), (ids[0],))
+                cr.execute("""SELECT "%s"
+                              FROM "%s"
+                              WHERE "%s" %s %%s""" % (s, f, w, op), (ids[0],))  # not_a_user_entry
                 res.extend([r[0] for r in cr.fetchall()])
             else:
                 for i in range(0, len(ids), cr.IN_MAX):
                     subids = ids[i:i+cr.IN_MAX]
-                    cr.execute('SELECT "%s"'    \
-                               '  FROM "%s"'    \
-                               '  WHERE "%s" IN %%s' % (s, f, w),(tuple(subids),))
+                    cr.execute("""SELECT "%s"
+                                  FROM "%s"
+                                  WHERE "%s" IN %%s""" % (s, f, w),(tuple(subids),))  # not_a_user_entry
                     res.extend([r[0] for r in cr.fetchall()])
         else:
-            cr.execute('SELECT distinct("%s")'    \
-                       '  FROM "%s" where "%s" is not null'  % (s, f, s)),
+            cr.execute('SELECT distinct("%s")  FROM "%s" where "%s" is not null'  % (s, f, s))   # not_a_user_entry
             res.extend([r[0] for r in cr.fetchall()])
         return res
 

=== modified file 'bin/osv/fields.py'
--- bin/osv/fields.py	2017-05-22 13:59:51 +0000
+++ bin/osv/fields.py	2017-10-06 09:59:17 +0000
@@ -105,7 +105,7 @@
         pass
 
     def set(self, cr, obj, id, name, value, user=None, context=None):
-        cr.execute('update '+obj._table+' set '+name+'='+self._symbol_set[0]+' where id=%s', (self._symbol_set[1](value), id))
+        cr.execute('update '+obj._table+' set '+name+'='+self._symbol_set[0]+' where id=%s', (self._symbol_set[1](value), id))  # not_a_user_entry
 
     def set_memory(self, cr, obj, id, name, value, user=None, context=None):
         raise Exception(_('Not implemented set_memory method !'))
@@ -334,9 +334,9 @@
         self._table = obj_src.pool.get(self._obj)._table
         if act[0] == 0:
             id_new = obj.create(cr, user, act[1])
-            cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (id_new, id))
+            cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (id_new, id))  # not_a_user_entry
         else:
-            cr.execute('select '+field+' from '+obj_src._table+' where id=%s', (act[0],))
+            cr.execute('select '+field+' from '+obj_src._table+' where id=%s', (act[0],))  # not_a_user_entry
             id = cr.fetchone()[0]
             obj.write(cr, user, [id], act[1], context=context)
 
@@ -401,20 +401,20 @@
             for act in values:
                 if act[0] == 0:
                     id_new = obj.create(cr, act[2])
-                    cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (id_new, id))
+                    cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (id_new, id))  # not_a_user_entry
                 elif act[0] == 1:
                     obj.write(cr, [act[1]], act[2], context=context)
                 elif act[0] == 2:
-                    cr.execute('delete from '+self._table+' where id=%s', (act[1],))
+                    cr.execute('delete from '+self._table+' where id=%s', (act[1],))  # not_a_user_entry
                 elif act[0] == 3 or act[0] == 5:
-                    cr.execute('update '+obj_src._table+' set '+field+'=null where id=%s', (id,))
+                    cr.execute('update '+obj_src._table+' set '+field+'=null where id=%s', (id,))  # not_a_user_entry
                 elif act[0] == 4:
-                    cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (act[1], id))
+                    cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (act[1], id))  # not_a_user_entry
         else:
             if values:
-                cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (values, id))
+                cr.execute('update '+obj_src._table+' set '+field+'=%s where id=%s', (values, id))  # not_a_user_entry
             else:
-                cr.execute('update '+obj_src._table+' set '+field+'=null where id=%s', (id,))
+                cr.execute('update '+obj_src._table+' set '+field+'=null where id=%s', (id,))  # not_a_user_entry
 
     def search(self, cr, obj, args, name, value, offset=0, limit=None, uid=None, context=None):
         return obj.pool.get(self._obj).search(cr, uid, args+self._domain+[('name', 'like', value)], offset, limit, context=context)
@@ -524,15 +524,15 @@
             elif act[0] == 2:
                 obj.unlink(cr, user, [act[1]], context=context)
             elif act[0] == 3:
-                cr.execute('update '+_table+' set '+self._fields_id+'=null where id=%s', (act[1],))
+                cr.execute('update '+_table+' set '+self._fields_id+'=null where id=%s', (act[1],))  # not_a_user_entry
             elif act[0] == 4:
-                cr.execute('update '+_table+' set '+self._fields_id+'=%s where id=%s', (id, act[1]))
+                cr.execute('update '+_table+' set '+self._fields_id+'=%s where id=%s', (id, act[1]))  # not_a_user_entry
             elif act[0] == 5:
-                cr.execute('update '+_table+' set '+self._fields_id+'=null where '+self._fields_id+'=%s', (id,))
+                cr.execute('update '+_table+' set '+self._fields_id+'=null where '+self._fields_id+'=%s', (id,))  # not_a_user_entry
             elif act[0] == 6:
                 obj.write(cr, user, act[2], {self._fields_id:id}, context=context or {})
                 ids2 = act[2] or [0]
-                cr.execute('select id from '+_table+' where '+self._fields_id+'=%s and id <> ALL (%s)', (id,ids2))
+                cr.execute('select id from '+_table+' where '+self._fields_id+'=%s and id <> ALL (%s)', (id,ids2))  # not_a_user_entry
                 ids3 = map(lambda x:x[0], cr.fetchall())
                 obj.write(cr, user, ids3, {self._fields_id:False}, context=context or {})
         return result
@@ -601,24 +601,25 @@
         if self._limit is not None:
             limit_str = ' LIMIT %d' % self._limit
 
-        query = 'SELECT %(rel)s.%(id2)s, %(rel)s.%(id1)s \
-                   FROM %(rel)s, %(from_c)s \
-                  WHERE %(rel)s.%(id1)s IN %%s \
-                    AND %(rel)s.%(id2)s = %(tbl)s.id \
-                 %(where_c)s  \
-                 %(order_by)s \
-                 %(limit)s \
-                 OFFSET %(offset)d' \
-            % {'rel': self._rel,
-               'from_c': from_c,
-               'tbl': obj._table,
-               'id1': self._id1,
-               'id2': self._id2,
-               'where_c': where_c,
-               'limit': limit_str,
-               'order_by': order_by,
-               'offset': offset,
-               }
+        query = """
+        SELECT %(rel)s.%(id2)s, %(rel)s.%(id1)s
+        FROM %(rel)s, %(from_c)s
+        WHERE %(rel)s.%(id1)s IN %%s
+            AND %(rel)s.%(id2)s = %(tbl)s.id
+            %(where_c)s
+        %(order_by)s
+        %(limit)s
+        OFFSET %(offset)d""" % {  # not_a_user_entry
+            'rel': self._rel,
+            'from_c': from_c,
+            'tbl': obj._table,
+            'id1': self._id1,
+            'id2': self._id2,
+            'where_c': where_c,
+            'limit': limit_str,
+            'order_by': order_by,
+            'offset': offset,
+        }
         cr.execute(query, [tuple(ids),] + where_params)
         for r in cr.fetchall():
             res[r[1]].append(r[0])
@@ -635,20 +636,20 @@
                 continue
             if act[0] == 0:
                 idnew = obj.create(cr, user, act[2])
-                cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s,%s)', (id, idnew))
+                cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s,%s)', (id, idnew))  # not_a_user_entry
             elif act[0] == 1:
                 obj.write(cr, user, [act[1]], act[2], context=context)
             elif act[0] == 2:
                 obj.unlink(cr, user, [act[1]], context=context)
             elif act[0] == 3:
-                cr.execute('delete from '+self._rel+' where ' + self._id1 + '=%s and '+ self._id2 + '=%s', (id, act[1]))
+                cr.execute('delete from '+self._rel+' where ' + self._id1 + '=%s and '+ self._id2 + '=%s', (id, act[1]))  # not_a_user_entry
             elif act[0] == 4:
                 # following queries are in the same transaction - so should be relatively safe
-                cr.execute('SELECT 1 FROM '+self._rel+' WHERE '+self._id1+' = %s and '+self._id2+' = %s', (id, act[1]))
+                cr.execute('SELECT 1 FROM '+self._rel+' WHERE '+self._id1+' = %s and '+self._id2+' = %s', (id, act[1]))  # not_a_user_entry
                 if not cr.fetchone():
-                    cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s,%s)', (id, act[1]))
+                    cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s,%s)', (id, act[1]))  # not_a_user_entry
             elif act[0] == 5:
-                cr.execute('update '+self._rel+' set '+self._id2+'=null where '+self._id2+'=%s', (id,))
+                cr.execute('update '+self._rel+' set '+self._id2+'=null where '+self._id2+'=%s', (id,))  # not_a_user_entry
             elif act[0] == 6:
 
                 d1, d2,tables = obj.pool.get('ir.rule').domain_get(cr, user, obj._name, context=context)
@@ -656,10 +657,10 @@
                     d1 = ' and ' + ' and '.join(d1)
                 else:
                     d1 = ''
-                cr.execute('delete from '+self._rel+' where '+self._id1+'=%s AND '+self._id2+' IN (SELECT '+self._rel+'.'+self._id2+' FROM '+self._rel+', '+','.join(tables)+' WHERE '+self._rel+'.'+self._id1+'=%s AND '+self._rel+'.'+self._id2+' = '+obj._table+'.id '+ d1 +')', [id, id]+d2)
+                cr.execute('delete from '+self._rel+' where '+self._id1+'=%s AND '+self._id2+' IN (SELECT '+self._rel+'.'+self._id2+' FROM '+self._rel+', '+','.join(tables)+' WHERE '+self._rel+'.'+self._id1+'=%s AND '+self._rel+'.'+self._id2+' = '+obj._table+'.id '+ d1 +')', [id, id]+d2)   # not_a_user_entry
 
                 for act_nbr in act[2]:
-                    cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s, %s)', (id, act_nbr))
+                    cr.execute('insert into '+self._rel+' ('+self._id1+','+self._id2+') values (%s, %s)', (id, act_nbr))    # not_a_user_entry
 
     #
     # TODO: use a name_search

=== modified file 'bin/osv/orm.py'
--- bin/osv/orm.py	2017-08-18 14:26:52 +0000
+++ bin/osv/orm.py	2017-10-06 09:59:17 +0000
@@ -1907,7 +1907,7 @@
             cr.execute("""
                 SELECT reltuples::BIGINT AS approximate_row_count
                 FROM pg_class WHERE relname = '%s'
-            """ % self._table)
+            """ % self._table)  # not_a_user_entry
             approximative_result = cr.fetchall()
             approximative_result = approximative_result and approximative_result[0][0] or 0
             # check if approximative is big
@@ -2679,7 +2679,7 @@
         offset_str = offset and ' offset %d' % offset or ''
         if len(groupby_list) < 2 and context.get('group_by_no_leaf'):
             group_count = '_'
-        cr.execute('SELECT min(%s.id) AS id, count(%s.id) AS %s_count' % (self._table, self._table, group_count) + (flist and ',') + flist + ' FROM ' + from_clause + where_clause + gb + limit_str + offset_str, where_clause_params)
+        cr.execute('SELECT min(%s.id) AS id, count(%s.id) AS %s_count' % (self._table, self._table, group_count) + (flist and ',') + flist + ' FROM ' + from_clause + where_clause + gb + limit_str + offset_str, where_clause_params)  # not_a_user_entry
         alldata = {}
         groupby = group_by
         for r in cr.dictfetchall():
@@ -2759,7 +2759,7 @@
                 where = self._parent_name+' IS NULL'
             if self._parent_order:
                 where += ' order by '+self._parent_order
-            cr.execute('SELECT id FROM '+self._table+' WHERE '+where)
+            cr.execute('SELECT id FROM '+self._table+' WHERE '+where)  # not_a_user_entry
             pos2 = pos + 1
             for id in cr.fetchall():
                 pos2 = browse_rec(id[0], pos2)
@@ -2780,8 +2780,8 @@
         logger = netsvc.Logger()
         logger.notifyChannel('data', netsvc.LOG_INFO, "storing computed values of fields.function '%s'" % (k,))
         ss = self._columns[k]._symbol_set
-        update_query = 'UPDATE "%s" SET "%s"=%s WHERE id=%%s' % (self._table, k, ss[0])
-        cr.execute('SELECT id FROM '+self._table)
+        update_query = 'UPDATE "%s" SET "%s"=%s WHERE id=%%s' % (self._table, k, ss[0])  # not_a_user_entry
+        cr.execute('SELECT id FROM '+self._table)  # not_a_user_entry
         ids_lst = map(lambda x: x[0], cr.fetchall())
 
         migrate = False
@@ -2842,7 +2842,7 @@
                 self.__logger.debug("column %s is in the table %s but not in the corresponding object %s",
                                     column['attname'], self._table, self._name)
             if column['attnotnull']:
-                cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" DROP NOT NULL' % (self._table, column['attname']))
+                cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" DROP NOT NULL' % (self._table, column['attname']))  # not_a_user_entry
                 self.__schema.debug("Table '%s': column '%s': dropped NOT NULL constraint",
                                     self._table, column['attname'])
 
@@ -2878,8 +2878,8 @@
         if getattr(self, '_auto', True):
             cr.execute("SELECT relname FROM pg_class WHERE relkind IN ('r','v') AND relname=%s", (self._table,))
             if not cr.rowcount:
-                cr.execute('CREATE TABLE "%s" (id SERIAL NOT NULL, PRIMARY KEY(id)) WITHOUT OIDS' % (self._table,))
-                cr.execute("COMMENT ON TABLE \"%s\" IS '%s'" % (self._table, self._description.replace("'", "''")))
+                cr.execute('CREATE TABLE "%s" (id SERIAL NOT NULL, PRIMARY KEY(id)) WITHOUT OIDS' % (self._table,))  # not_a_user_entry
+                cr.execute("COMMENT ON TABLE \"%s\" IS '%s'" % (self._table, self._description.replace("'", "''")))  # not_a_user_entry
                 create = True
                 self.__schema.debug("Table '%s': created", self._table)
 
@@ -2890,8 +2890,8 @@
                     WHERE c.relname=%s AND a.attname=%s AND c.oid=a.attrelid
                     """, (self._table, 'parent_left'))
                 if not cr.rowcount:
-                    cr.execute('ALTER TABLE "%s" ADD COLUMN "parent_left" INTEGER' % (self._table,))
-                    cr.execute('ALTER TABLE "%s" ADD COLUMN "parent_right" INTEGER' % (self._table,))
+                    cr.execute('ALTER TABLE "%s" ADD COLUMN "parent_left" INTEGER' % (self._table,))  # not_a_user_entry
+                    cr.execute('ALTER TABLE "%s" ADD COLUMN "parent_right" INTEGER' % (self._table,))  # not_a_user_entry
                     if 'parent_left' not in self._columns:
                         self.__logger.error('create a column parent_left on object %s: fields.integer(\'Left Parent\', select=1)',
                                             self._table)
@@ -2929,7 +2929,7 @@
                          WHERE c.relname=%s AND a.attname=%s AND c.oid=a.attrelid
                         """, (self._table, k))
                     if not cr.rowcount:
-                        cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, logs[k]))
+                        cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, logs[k]))  # not_a_user_entry
                         cr.commit()
                         self.__schema.debug("Table '%s': added column '%s' with definition=%s",
                                             self._table, k, logs[k])
@@ -2969,7 +2969,7 @@
                         cr.execute("SELECT count(1) as c FROM pg_class c,pg_attribute a WHERE c.relname=%s AND a.attname=%s AND c.oid=a.attrelid", (f._obj, f._fields_id))
                         res = cr.fetchone()[0]
                         if not res:
-                            cr.execute('ALTER TABLE "%s" ADD FOREIGN KEY (%s) REFERENCES "%s" ON DELETE SET NULL' % (self._obj, f._fields_id, f._table))
+                            cr.execute('ALTER TABLE "%s" ADD FOREIGN KEY (%s) REFERENCES "%s" ON DELETE SET NULL' % (self._obj, f._fields_id, f._table))  # not_a_user_entry
                             self.__schema.debug("Table '%s': added foreign key '%s' with definition=REFERENCES \"%s\" ON DELETE SET NULL",
                                                 self._obj, f._fields_id, f._table)
                 elif isinstance(f, fields.many2many):
@@ -2979,10 +2979,10 @@
                             raise except_orm('Programming Error', ('There is no reference available for %s') % (f._obj,))
                         ref = self.pool.get(f._obj)._table
 #                        ref = f._obj.replace('.', '_')
-                        cr.execute('CREATE TABLE "%s" ("%s" INTEGER NOT NULL REFERENCES "%s" ON DELETE CASCADE, "%s" INTEGER NOT NULL REFERENCES "%s" ON DELETE CASCADE, UNIQUE("%s","%s")) WITH OIDS' % (f._rel, f._id1, self._table, f._id2, ref, f._id1, f._id2))
-                        cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (f._rel, f._id1, f._rel, f._id1))
-                        cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (f._rel, f._id2, f._rel, f._id2))
-                        cr.execute("COMMENT ON TABLE \"%s\" IS 'RELATION BETWEEN %s AND %s'" % (f._rel, self._table, ref))
+                        cr.execute('CREATE TABLE "%s" ("%s" INTEGER NOT NULL REFERENCES "%s" ON DELETE CASCADE, "%s" INTEGER NOT NULL REFERENCES "%s" ON DELETE CASCADE, UNIQUE("%s","%s")) WITH OIDS' % (f._rel, f._id1, self._table, f._id2, ref, f._id1, f._id2))  # not_a_user_entry
+                        cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (f._rel, f._id1, f._rel, f._id1))  # not_a_user_entry
+                        cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (f._rel, f._id2, f._rel, f._id2))  # not_a_user_entry
+                        cr.execute("COMMENT ON TABLE \"%s\" IS 'RELATION BETWEEN %s AND %s'" % (f._rel, self._table, ref))  # not_a_user_entry
                         cr.commit()
                         self.__schema.debug("Create table '%s': relation between '%s' and '%s'",
                                             f._rel, self._table, ref)
@@ -2998,7 +2998,7 @@
                                    "AND a.atttypid=t.oid", (self._table, f.oldname))
                         res_old = cr.dictfetchall()
                         if res_old and len(res_old) == 1:
-                            cr.execute('ALTER TABLE "%s" RENAME "%s" TO "%s"' % (self._table, f.oldname, k))
+                            cr.execute('ALTER TABLE "%s" RENAME "%s" TO "%s"' % (self._table, f.oldname, k))  # not_a_user_entry
                             res = res_old
                             res[0]['attname'] = k
                             self.__schema.debug("Table '%s': renamed column '%s' to '%s'",
@@ -3013,7 +3013,7 @@
                                 not getattr(f, 'nodrop', False):
                             self.__logger.info('column %s (%s) in table %s removed: converted to a function !\n',
                                                k, f.string, self._table)
-                            cr.execute('ALTER TABLE "%s" DROP COLUMN "%s" CASCADE' % (self._table, k))
+                            cr.execute('ALTER TABLE "%s" DROP COLUMN "%s" CASCADE' % (self._table, k))  # not_a_user_entry
                             cr.commit()
                             self.__schema.debug("Table '%s': dropped column '%s' with cascade",
                                                 self._table, k)
@@ -3033,10 +3033,10 @@
                                 ('float8', 'float', get_pg_type(f)[1], '::'+get_pg_type(f)[1]),
                             ]
                             if f_pg_type == 'varchar' and f._type == 'char' and f_pg_size < f.size:
-                                cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO temp_change_size' % (self._table, k))
-                                cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" VARCHAR(%d)' % (self._table, k, f.size))
-                                cr.execute('UPDATE "%s" SET "%s"=temp_change_size::VARCHAR(%d)' % (self._table, k, f.size))
-                                cr.execute('ALTER TABLE "%s" DROP COLUMN temp_change_size CASCADE' % (self._table,))
+                                cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO temp_change_size' % (self._table, k))  # not_a_user_entry
+                                cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" VARCHAR(%d)' % (self._table, k, f.size))  # not_a_user_entry
+                                cr.execute('UPDATE "%s" SET "%s"=temp_change_size::VARCHAR(%d)' % (self._table, k, f.size))  # not_a_user_entry
+                                cr.execute('ALTER TABLE "%s" DROP COLUMN temp_change_size CASCADE' % (self._table,))  # not_a_user_entry
                                 cr.commit()
                                 self.__schema.debug("Table '%s': column '%s' (type varchar) changed size from %s to %s",
                                                     self._table, k, f_pg_size, f.size)
@@ -3044,10 +3044,10 @@
                                 if (f_pg_type==c[0]) and (f._type==c[1]):
                                     if f_pg_type != f_obj_type:
                                         ok = True
-                                        cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO temp_change_size' % (self._table, k))
-                                        cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, c[2]))
-                                        cr.execute(('UPDATE "%s" SET "%s"=temp_change_size'+c[3]) % (self._table, k))
-                                        cr.execute('ALTER TABLE "%s" DROP COLUMN temp_change_size CASCADE' % (self._table,))
+                                        cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO temp_change_size' % (self._table, k))  # not_a_user_entry
+                                        cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, c[2]))  # not_a_user_entry
+                                        cr.execute(('UPDATE "%s" SET "%s"=temp_change_size'+c[3]) % (self._table, k))  # not_a_user_entry
+                                        cr.execute('ALTER TABLE "%s" DROP COLUMN temp_change_size CASCADE' % (self._table,))  # not_a_user_entry
                                         cr.commit()
                                         self.__schema.debug("Table '%s': column '%s' changed type from %s to %s",
                                                             self._table, k, c[0], c[1])
@@ -3066,10 +3066,10 @@
                                             break
                                         i += 1
                                     if f_pg_notnull:
-                                        cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" DROP NOT NULL' % (self._table, k))
-                                    cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO "%s"' % (self._table, k, newname))
-                                    cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, get_pg_type(f)[1]))
-                                    cr.execute("COMMENT ON COLUMN %s.%s IS '%s'" % (self._table, k, f.string.replace("'", "''")))
+                                        cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" DROP NOT NULL' % (self._table, k))  # not_a_user_entry
+                                    cr.execute('ALTER TABLE "%s" RENAME COLUMN "%s" TO "%s"' % (self._table, k, newname))  # not_a_user_entry
+                                    cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, get_pg_type(f)[1]))  # not_a_user_entry
+                                    cr.execute("COMMENT ON COLUMN %s.%s IS '%s'" % (self._table, k, f.string.replace("'", "''")))  # not_a_user_entry
                                     self.__schema.debug("Table '%s': column '%s' has changed type (DB=%s, def=%s), data moved to column %s !",
                                                         self._table, k, f_pg_type, f._type, newname)
                                     to_migrate.append((newname, k))
@@ -3085,12 +3085,12 @@
 
                                     if default is not None:
                                         ss = self._columns[k]._symbol_set
-                                        query = 'UPDATE "%s" SET "%s"=%s WHERE "%s" is NULL' % (self._table, k, ss[0], k)
+                                        query = 'UPDATE "%s" SET "%s"=%s WHERE "%s" is NULL' % (self._table, k, ss[0], k)  # not_a_user_entry
                                         cr.execute(query, (ss[1](default),))
                                 # add the NOT NULL constraint
                                 cr.commit()
                                 try:
-                                    cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" SET NOT NULL' % (self._table, k), log_exceptions=False)
+                                    cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" SET NOT NULL' % (self._table, k), log_exceptions=False)  # not_a_user_entry
                                     cr.commit()
                                     self.__schema.debug("Table '%s': column '%s': added NOT NULL constraint",
                                                         self._table, k)
@@ -3101,7 +3101,7 @@
                                     self.__schema.warn(msg, self._table, k, self._table, k)
                                 cr.commit()
                             elif not f.required and f_pg_notnull == 1:
-                                cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" DROP NOT NULL' % (self._table, k))
+                                cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" DROP NOT NULL' % (self._table, k))  # not_a_user_entry
                                 cr.commit()
                                 self.__schema.debug("Table '%s': column '%s': dropped NOT NULL constraint",
                                                     self._table, k)
@@ -3110,7 +3110,7 @@
                             cr.execute("SELECT indexname FROM pg_indexes WHERE indexname = %s and tablename = %s", (indexname, self._table))
                             res2 = cr.dictfetchall()
                             if not res2 and f.select:
-                                cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (self._table, k, self._table, k))
+                                cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (self._table, k, self._table, k))  # not_a_user_entry
                                 cr.commit()
                                 if f._type == 'text':
                                     # FIXME: for fields.text columns we should try creating GIN indexes instead (seems most suitable for an ERP context)
@@ -3120,7 +3120,7 @@
                                         "Use a search view instead if you simply want to make the field searchable."
                                     self.__schema.warn(msg, self._table, k, f._type)
                             if res2 and not f.select:
-                                cr.execute('DROP INDEX "%s_%s_index"' % (self._table, k))
+                                cr.execute('DROP INDEX "%s_%s_index"' % (self._table, k))  # not_a_user_entry
                                 cr.commit()
                                 msg = "Table '%s': dropping index for column '%s' of type '%s' as it is not required anymore"
                                 self.__schema.debug(msg, self._table, k, f._type)
@@ -3146,8 +3146,8 @@
                                     res2 = cr.dictfetchall()
                                     if res2:
                                         if res2[0]['confdeltype'] != POSTGRES_CONFDELTYPES.get(f.ondelete.upper(), 'a'):
-                                            cr.execute('ALTER TABLE "' + self._table + '" DROP CONSTRAINT "' + res2[0]['conname'] + '"')
-                                            cr.execute('ALTER TABLE "' + self._table + '" ADD FOREIGN KEY ("' + k + '") REFERENCES "' + ref + '" ON DELETE ' + f.ondelete)
+                                            cr.execute('ALTER TABLE "' + self._table + '" DROP CONSTRAINT "' + res2[0]['conname'] + '"')  # not_a_user_entry
+                                            cr.execute('ALTER TABLE "' + self._table + '" ADD FOREIGN KEY ("' + k + '") REFERENCES "' + ref + '" ON DELETE ' + f.ondelete)  # not_a_user_entry
                                             cr.commit()
                                             self.__schema.debug("Table '%s': column '%s': XXX",
                                                                 self._table, k)
@@ -3156,8 +3156,8 @@
                     else:
                         if not isinstance(f, fields.function) or f.store:
                             # add the missing field
-                            cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, get_pg_type(f)[1]))
-                            cr.execute("COMMENT ON COLUMN %s.%s IS '%s'" % (self._table, k, f.string.replace("'", "''")))
+                            cr.execute('ALTER TABLE "%s" ADD COLUMN "%s" %s' % (self._table, k, get_pg_type(f)[1]))  # not_a_user_entry
+                            cr.execute("COMMENT ON COLUMN %s.%s IS '%s'" % (self._table, k, f.string.replace("'", "''")))  # not_a_user_entry
                             self.__schema.debug("Table '%s': added column '%s' with definition=%s",
                                                 self._table, k, get_pg_type(f)[1])
 
@@ -3169,7 +3169,7 @@
                                     default = self._defaults[k]
 
                                 ss = self._columns[k]._symbol_set
-                                query = 'UPDATE "%s" SET "%s"=%s' % (self._table, k, ss[0])
+                                query = 'UPDATE "%s" SET "%s"=%s' % (self._table, k, ss[0])  # not_a_user_entry
                                 cr.execute(query, (ss[1](default),))
                                 cr.commit()
                                 netsvc.Logger().notifyChannel('data', netsvc.LOG_DEBUG, "Table '%s': setting default value of new column %s" % (self._table, k))
@@ -3188,15 +3188,15 @@
 #                                ref = f._obj.replace('.', '_')
                                 # ir_actions is inherited so foreign key doesn't work on it
                                 if ref != 'ir_actions':
-                                    cr.execute('ALTER TABLE "%s" ADD FOREIGN KEY ("%s") REFERENCES "%s" ON DELETE %s' % (self._table, k, ref, f.ondelete))
+                                    cr.execute('ALTER TABLE "%s" ADD FOREIGN KEY ("%s") REFERENCES "%s" ON DELETE %s' % (self._table, k, ref, f.ondelete))  # not_a_user_entry
                                     self.__schema.debug("Table '%s': added foreign key '%s' with definition=REFERENCES \"%s\" ON DELETE %s",
                                                         self._table, k, ref, f.ondelete)
                             if f.select:
-                                cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (self._table, k, self._table, k))
+                                cr.execute('CREATE INDEX "%s_%s_index" ON "%s" ("%s")' % (self._table, k, self._table, k))  # not_a_user_entry
                             if f.required:
                                 try:
                                     cr.commit()
-                                    cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" SET NOT NULL' % (self._table, k), log_exceptions=False)
+                                    cr.execute('ALTER TABLE "%s" ALTER COLUMN "%s" SET NOT NULL' % (self._table, k), log_exceptions=False)  # not_a_user_entry
                                     self.__schema.debug("Table '%s': column '%s': added a NOT NULL constraint",
                                                         self._table, k)
                                 except Exception:
@@ -3514,7 +3514,7 @@
             fields_pre2 = map(convert_field, fields_pre)
             order_by = self._parent_order or self._order
             select_fields = ','.join(fields_pre2 + [self._table + '.id'])
-            query = 'SELECT %s FROM %s WHERE %s.id IN %%s' % (select_fields,
+            query = 'SELECT %s FROM %s WHERE %s.id IN %%s' % (select_fields,  # ignore_sql_check
                                                               ','.join(tables), self._table)
             if rule_clause:
                 query = ''.join((query, ' AND ', ' OR '.join(rule_clause)))
@@ -3679,7 +3679,7 @@
         query = '''SELECT %s, __imd.module, __imd.name
                    FROM %s LEFT JOIN ir_model_data __imd
                        ON (__imd.model = %%s and __imd.res_id = %s.id)
-                   WHERE %s.id IN %%s''' % (fields_str, quoted_table, quoted_table, quoted_table)
+                   WHERE %s.id IN %%s''' % (fields_str, quoted_table, quoted_table, quoted_table)  # not_a_user_entry
         cr.execute(query, (self._name, tuple(ids)))
         res = cr.dictfetchall()
         for r in res:
@@ -3711,7 +3711,7 @@
                     ids_to_check.extend([id, update_date])
             if not ids_to_check:
                 continue
-            cr.execute("SELECT id FROM %s WHERE %s" % (self._table, " OR ".join([check_clause]*(len(ids_to_check)/2))), tuple(ids_to_check))
+            cr.execute("SELECT id FROM %s WHERE %s" % (self._table, " OR ".join([check_clause]*(len(ids_to_check)/2))), tuple(ids_to_check))  # not_a_user_entry
             res = cr.fetchone()
             if res:
                 # mention the first one only to keep the error message readable
@@ -3784,8 +3784,7 @@
             cr.execute('DELETE FROM ir_attachment WHERE res_id IN %s AND res_model = %s',
                        (sub_ids, self._name))
 
-            cr.execute('DELETE FROM ' + self._table + ' ' \
-                       'WHERE id IN %s', (sub_ids,))
+            cr.execute('DELETE FROM ' + self._table + ' WHERE id IN %s', (sub_ids,))  # not_a_user_entry
 
             # Removing the ir_model_data reference if the record being deleted is a record created by xml/csv file,
             # as these are not connected with real database foreign keys, and would be dangling references.
@@ -3809,7 +3808,7 @@
         for order, current_obj, store_ids, field_list in result_store:
             if current_obj != self._name:
                 obj = self.pool.get(current_obj)
-                cr.execute('SELECT id from '+obj._table+' WHERE id IN %s', (tuple(store_ids),))
+                cr.execute('SELECT id from '+obj._table+' WHERE id IN %s', (tuple(store_ids),))  # not_a_user_entry
                 rids = map(lambda x: x[0], cr.fetchall())
                 if rids:
                     obj._store_set_values(cr, uid, rids, field_list, context)
@@ -3926,8 +3925,7 @@
                     (self._table, self._parent_name, self._parent_name)
                 cr.execute(query, (tuple(ids), parent_val))
             else:
-                query = "SELECT id FROM %s WHERE id IN %%s AND (%s IS NOT NULL)" % \
-                    (self._table, self._parent_name)
+                query = "SELECT id FROM %s WHERE id IN %%s AND (%s IS NOT NULL)" % (self._table, self._parent_name)  # not_a_user_entry
                 cr.execute(query, (tuple(ids),))
             parents_changed = map(operator.itemgetter(0), cr.fetchall())
 
@@ -4051,7 +4049,7 @@
                     clause, params = '%s IS NULL' % (self._parent_name,), ()
 
                 for current_id in parents_changed:
-                    cr.execute('SELECT parent_left, parent_right FROM %s WHERE id=%%s' % (self._table,), (current_id,))
+                    cr.execute('SELECT parent_left, parent_right FROM %s WHERE id=%%s' % (self._table,), (current_id,))  # not_a_user_entry
                     pleft, pright = cr.fetchone()
                     distance = pright - pleft + 1
 
@@ -4059,7 +4057,7 @@
                     # this can _not_ be fetched outside the loop, as it needs to be refreshed
                     # after each update, in case several nodes are sequentially inserted one
                     # next to the other (i.e computed incrementally)
-                    cr.execute('SELECT parent_right, id FROM %s WHERE %s ORDER BY %s' % (self._table, clause, order), params)
+                    cr.execute('SELECT parent_right, id FROM %s WHERE %s ORDER BY %s' % (self._table, clause, order), params)  # not_a_user_entry
                     parents = cr.fetchall()
 
                     # Find Position of the element
@@ -4180,7 +4178,7 @@
         # Try-except added to filter the creation of those records whose fields are readonly.
         # Example : any dashboard which has all the fields readonly.(due to Views(database views))
         try:
-            cr.execute("SELECT nextval('"+self._sequence+"')")
+            cr.execute("SELECT nextval('"+self._sequence+"')")  # not_a_user_entry
         except:
             raise except_orm(_('UserError'),
                              _('You cannot perform this operation. New Record Creation is not allowed for this object as this object is for reporting purpose.'))
@@ -4222,8 +4220,7 @@
                 for group in groups:
                     module = group.split(".")[0]
                     grp = group.split(".")[1]
-                    cr.execute("select count(*) from res_groups_users_rel where gid IN (select res_id from ir_model_data where name='%s' and module='%s' and model='%s') and uid=%s" % \
-                               (grp, module, 'res.groups', user))
+                    cr.execute("select count(*) from res_groups_users_rel where gid IN (select res_id from ir_model_data where name='%s' and module='%s' and model='%s') and uid=%s" % (grp, module, 'res.groups', user))   # not_a_user_entry
                     readonly = cr.fetchall()
                     if readonly[0][0] >= 1:
                         edit = True
@@ -4269,15 +4266,15 @@
                             break
                         pleft_old = pleft
                     if not pleft_old:
-                        cr.execute('select parent_left from '+self._table+' where id=%s', (parent,))
+                        cr.execute('select parent_left from '+self._table+' where id=%s', (parent,))  # not_a_user_entry
                         pleft_old = cr.fetchone()[0]
                     pleft = pleft_old
                 else:
-                    cr.execute('select max(parent_right) from '+self._table)
+                    cr.execute('select max(parent_right) from '+self._table)  # not_a_user_entry
                     pleft = cr.fetchone()[0] or 0
-                cr.execute('update '+self._table+' set parent_left=parent_left+2 where parent_left>%s', (pleft,))
-                cr.execute('update '+self._table+' set parent_right=parent_right+2 where parent_right>%s', (pleft,))
-                cr.execute('update '+self._table+' set parent_left=%s,parent_right=%s where id=%s', (pleft+1, pleft+2, id_new))
+                cr.execute('update '+self._table+' set parent_left=parent_left+2 where parent_left>%s', (pleft,))  # not_a_user_entry
+                cr.execute('update '+self._table+' set parent_right=parent_right+2 where parent_right>%s', (pleft,))  # not_a_user_entry
+                cr.execute('update '+self._table+' set parent_left=%s,parent_right=%s where id=%s', (pleft+1, pleft+2, id_new))  # not_a_user_entry
 
         # default element in context must be remove when call a one2many or many2many
         result = []
@@ -4364,7 +4361,7 @@
         field_flag = False
         field_dict = {}
         if self._log_access:
-            cr.execute('select id,write_date from '+self._table+' where id IN %s', (tuple(ids),))
+            cr.execute('select id,write_date from '+self._table+' where id IN %s', (tuple(ids),))  # not_a_user_entry
             res = cr.fetchall()
             for r in res:
                 if r[1]:
@@ -4893,7 +4890,7 @@
         if type(ids) in (int, long):
             ids = [ids]
         query = 'SELECT count(1) FROM "%s"' % (self._table)
-        cr.execute(query + "WHERE ID IN %s", (tuple(ids),))
+        cr.execute(query + "WHERE ID IN %s", (tuple(ids),))  # not_a_user_entry
         return cr.fetchone()[0] == len(ids)
 
     def check_recursion(self, cr, uid, ids, context=None, parent=None):
@@ -4919,7 +4916,7 @@
         if not parent:
             parent = self._parent_name
         ids_parent = ids[:]
-        query = 'SELECT distinct "%s" FROM "%s" WHERE id IN %%s' % (parent, self._table)
+        query = 'SELECT distinct "%s" FROM "%s" WHERE id IN %%s' % (parent, self._table)  # not_a_user_entry
         while ids_parent:
             ids_parent2 = []
             for i in range(0, len(ids), cr.IN_MAX):
@@ -4999,7 +4996,7 @@
         for column, table in cr.fetchall():
             if table == self._table:
                 continue
-            cr.execute("""SELECT count(id) FROM %s WHERE %s IN %%s""" % (table, column), (tuple(ids),))
+            cr.execute("""SELECT count(id) FROM %s WHERE %s IN %%s""" % (table, column), (tuple(ids),))  # not_a_user_entry
             res = cr.fetchall()
             if res[0][0]:
                 return True

=== modified file 'bin/service/web_services.py'
--- bin/service/web_services.py	2017-05-30 15:47:59 +0000
+++ bin/service/web_services.py	2017-10-06 09:59:17 +0000
@@ -38,6 +38,7 @@
 import locale
 import logging
 import datetime
+import string
 import csv
 import re
 from osv import osv
@@ -52,6 +53,14 @@
 from passlib.hash import bcrypt
 from report import report_sxw
 
+def _check_db_name(name):
+    '''Raise if the name is composed with unauthorized characters
+    '''
+    if name and isinstance(name, basestring):
+        # allow char, number, _ and -
+        if not re.match('^[a-zA-Z][a-zA-Z0-9_-]+$', name):
+            raise _("You must avoid all accents, space or special characters.")
+
 def export_csv(fields, result, result_file_path):
     try:
         with open(result_file_path, 'wb') as result_file:
@@ -131,11 +140,13 @@
         cr = db.cursor()
         try:
             cr.autocommit(True) # avoid transaction block
-            cr.execute("""CREATE DATABASE "%s" ENCODING 'unicode' TEMPLATE "template0" """ % name)
+            _check_db_name(name)
+            cr.execute("""CREATE DATABASE "%s" ENCODING 'unicode' TEMPLATE "template0" """ % name)  # ignore_sql_check
         finally:
             cr.close(True)
 
     def exp_create(self, db_name, demo, lang, user_password='admin'):
+        _check_db_name(db_name)
         self.id_protect.acquire()
         self.id += 1
         id = self.id
@@ -232,6 +243,7 @@
                 raise Exception, e
 
     def exp_drop(self, db_name):
+        _check_db_name(db_name)
         sql_db.close_db(db_name)
         logger = netsvc.Logger()
 
@@ -241,7 +253,7 @@
         drop_db = False
         try:
             try:
-                cr.execute('DROP DATABASE "%s"' % db_name)
+                cr.execute('DROP DATABASE "%s"' % db_name)  # ignore_sql_check
                 drop_db = True
             except Exception, e:
                 logger.notifyChannel("web-services", netsvc.LOG_ERROR,
@@ -265,6 +277,7 @@
             del os.environ['PGPASSWORD']
 
     def exp_dump_file(self, db_name):
+        _check_db_name(db_name)
         # get a tempfilename
         f = NamedTemporaryFile(delete=False)
         f_name = f.name
@@ -276,6 +289,7 @@
 
 
     def exp_dump(self, db_name):
+        _check_db_name(db_name)
         logger = netsvc.Logger()
         data, res = tools.pg_dump(db_name)
         if res:
@@ -285,6 +299,7 @@
         return base64.encodestring(data)
 
     def exp_restore_file(self, db_name, filename):
+        _check_db_name(db_name)
         try:
             logger = netsvc.Logger()
 
@@ -321,6 +336,7 @@
             raise
 
     def exp_restore(self, db_name, data):
+        _check_db_name(db_name)
         logging.getLogger('web-services').info("Restore DB from memory")
         buf=base64.decodestring(data)
         tmpfile = NamedTemporaryFile('w+b', delete=False)
@@ -330,6 +346,8 @@
         return self.exp_restore_file(db_name, tmpfile.name)
 
     def exp_rename(self, old_name, new_name):
+        _check_db_name(old_name)
+        _check_db_name(new_name)
         sql_db.close_db(old_name)
         logger = netsvc.Logger()
 
@@ -338,7 +356,7 @@
         cr.autocommit(True) # avoid transaction block
         try:
             try:
-                cr.execute('ALTER DATABASE "%s" RENAME TO "%s"' % (old_name, new_name))
+                cr.execute('ALTER DATABASE "%s" RENAME TO "%s"' % (old_name, new_name))  # ignore_sql_check
             except Exception, e:
                 logger.notifyChannel("web-services", netsvc.LOG_ERROR,
                                      'RENAME DB: %s -> %s failed:\n%s' % (old_name, new_name, e))
@@ -355,6 +373,7 @@
         return True
 
     def exp_db_exist(self, db_name):
+        _check_db_name(db_name)
         ## Not True: in fact, check if connection to database is possible. The database may exists
         return bool(sql_db.db_connect(db_name))
 
@@ -390,6 +409,7 @@
         """Return True if db_name is connected to a production SYNC_SERVER,
         False otherwise"""
 
+        _check_db_name(db_name)
         connection = sql_db.db_connect(db_name)
         # it the db connnected to a sync_server ?
         server_connecion_module = pooler.get_pool(db_name, upgrade_modules=False).get('sync.client.sync_server_connection')
@@ -427,6 +447,7 @@
         """
         if not dbname:
             return release.version
+        _check_db_name(dbname)
 
         db = sql_db.db_connect(dbname)
         cr = db.cursor()
@@ -860,6 +881,7 @@
 
     def exp_export(self, db_name, uid, fields, domain, model, fields_name,
                    group_by=None, export_format='csv', ids=None, context=None):
+        _check_db_name(db_name)
         res = {'result': None}
         db, pool = pooler.get_db_and_pool(db_name)
         cr = db.cursor()
@@ -1001,12 +1023,14 @@
         cr.close()
         return result_file_path
 
-    def exp_report(self, db, uid, object, ids, datas=None, context=None):
+    def exp_report(self, db_name, uid, object, ids, datas=None, context=None):
         if not datas:
             datas={}
         if not context:
             context={}
 
+        _check_db_name(db_name)
+
         self.id_protect.acquire()
         self.id += 1
         id = self.id
@@ -1015,7 +1039,7 @@
         self._reports[id] = {'uid': uid, 'result': False, 'state': False, 'exception': None}
 
         def go(id, uid, ids, datas, context):
-            cr = pooler.get_db(db).cursor()
+            cr = pooler.get_db(db_name).cursor()
             import traceback
             import sys
             try:

=== modified file 'bin/tools/sql.py'
--- bin/tools/sql.py	2009-10-20 10:52:23 +0000
+++ bin/tools/sql.py	2017-10-06 09:59:17 +0000
@@ -22,7 +22,7 @@
 def drop_view_if_exists(cr, viewname):
     cr.execute("select count(1) from pg_class where relkind=%s and relname=%s", ('v', viewname,))
     if cr.fetchone()[0]:
-        cr.execute("DROP view %s" % (viewname,))
+        cr.execute("DROP view %s" % (viewname,))  # not_a_user_entry
         cr.commit()
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:

=== removed directory 'doc/migrate'
=== removed directory 'doc/migrate/3.3.0-3.4.0'
=== removed file 'doc/migrate/3.3.0-3.4.0/README'
--- doc/migrate/3.3.0-3.4.0/README	2006-12-07 13:41:40 +0000
+++ doc/migrate/3.3.0-3.4.0/README	1970-01-01 00:00:00 +0000
@@ -1,35 +0,0 @@
-This document describes the steps to follow to migrate from a version 3.3.0 of Tiny ERP server to a version 3.4.0
-
-Warning: the migration scripts involved in this migration are only meant for 
-a standard Tiny ERP installation. It might not work or even break some data 
-if you added or modified some code to the default Tiny ERP distribution.
-
-To migrate a 3.3.0 server to version 3.4.0 you should:
-
-- stop Tiny ERP server 3.3.0
-
-- backup your database
-	For example: pg_dump terp330 > backup330.sql
-
-- run the pre.py script (located in this directory)
-	You might need to pass it some optional arguments so that it can connect 
-	to the database.
-
-	For example: python pre.py -d terp330
-
-- run TinyERP server 3.4.0 with "-u all" in the parameters
-	For example: ./tinyerp-server.py -d terp330 -u all
-
-- stop TinyERP server 3.4.0
-
-- run the post.py script (located in this directory)
-
-	You might need to pass it some optional arguments so that it can connect 
-	to the database.
-
-	For example: python post.py -d terp330
-
-- run TinyERP server 3.4.0 again with "-u all" in the parameters
-	For example: ./tinyerp-server.py -d terp330 -u all
-
-- you are ready to work with the new version.

=== removed file 'doc/migrate/3.3.0-3.4.0/post.py'
--- doc/migrate/3.3.0-3.4.0/post.py	2010-06-21 09:05:43 +0000
+++ doc/migrate/3.3.0-3.4.0/post.py	1970-01-01 00:00:00 +0000
@@ -1,146 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Gaetan de Menten, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ------------------------------------------- #
-# convert partner payment terms to properties #
-# ------------------------------------------- #
-
-# setup
-
-cr.execute("select id from ir_model_fields where name='property_payment_term' and model='res.partner'")
-fields_id = cr.fetchone()[0]
-
-cr.execute("select company_id from res_users where company_id is not null limit 1")
-company_id = cr.fetchone()[0]
-
-# get partners
-cr.execute("SELECT c.relname FROM pg_class c, pg_attribute a WHERE c.relname='res_partner' AND a.attname='payment_term' AND c.oid=a.attrelid")
-partners=[]
-drop_payment_term=False
-if cr.rowcount:
-    drop_payment_term=True
-    cr.execute("select id, payment_term from res_partner where payment_term is not null")
-    partners = cr.dictfetchall()
-
-# loop over them
-
-for partner in partners:
-    value = 'account.payment.term,%d' % partner['payment_term']
-    res_id = 'res.partner,%d' % partner['id']
-    cr.execute(
-        "insert into ir_property(name, value, res_id, company_id, fields_id) "\
-        "values(%s, %s, %s, %d, %d)", 
-        ('property_payment_term', value, res_id, company_id, fields_id))
-
-# remove the field
-if drop_payment_term:
-    cr.execute("alter table res_partner drop column payment_term")
-cr.execute("delete from ir_model_fields where model = 'res.partner' and name = 'payment_term'")
-
-cr.commit()
-
-# ------------------------ #
-# remove duplicate reports #
-# ------------------------ #
-
-cr.execute("select model, report_name from ir_act_report_xml group by model, report_name having count(*)>1")
-reports_wh_duplicates = cr.dictfetchall()
-
-cr.execute("select res_id from ir_model_data where model='ir.actions.report.xml'")
-registered_reports = cr.fetchall()
-reg_reports_ids = ','.join([str(id) for (id,) in registered_reports])
-
-for report in reports_wh_duplicates:
-    cr.execute("select id from ir_act_report_xml where model=%s and report_name=%s and id not in ("+reg_reports_ids+")", (report['model'], report['report_name']))
-    (id,) = cr.fetchone()
-    cr.execute("delete from ir_act_report_xml where id=%d", (id,))
-    cr.execute("delete from ir_values where value='ir.actions.report.xml,%d'", (id,))
-
-cr.commit()
-
-# ------------------------------------- #
-# remove duplicate workflow transitions #
-# ------------------------------------- #
-
-# this removes all transitions which are not registered in ir_model_data
-
-cr.execute("delete from wkf_transition where id not in (select res_id from ir_model_data where model='workflow.transition')")
-cr.commit()
-
-# -------------------------------- #
-# remove bad "default" menu action #
-# -------------------------------- #
-
-cr.execute("delete from ir_values where key='action' and model='ir.ui.menu' and res_id is null")
-cr.commit()
-
-cr.close()
-
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed file 'doc/migrate/3.3.0-3.4.0/pre.py'
--- doc/migrate/3.3.0-3.4.0/pre.py	2009-10-20 10:52:23 +0000
+++ doc/migrate/3.3.0-3.4.0/pre.py	1970-01-01 00:00:00 +0000
@@ -1,112 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Gaetan de Menten, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ------------------------- #
-# change some columns types #
-# ------------------------- #
-
-def change_column(cr, table, column, new_type, copy):
-    commands = [
-        "ALTER TABLE %s RENAME COLUMN %s TO temp_column" % (table, column),
-        "ALTER TABLE %s ADD COLUMN %s %s" % (table, column, new_type),
-        "ALTER TABLE %s DROP COLUMN temp_column" % table
-    ]
-    if copy:
-        commands.insert(
-            2, 
-            "UPDATE %s SET %s=temp_column::%s" % (table, column, new_type))
-
-    for command in commands:
-        cr.execute(command)
-
-change_column(cr, 'account_account_type', 'code_from', 'varchar(10)', False)
-change_column(cr, 'account_account_type', 'code_to', 'varchar(10)', False)
-cr.commit()
-
-# ----------------------------------------------------- #
-# add some fields (which cannot be added automatically) #
-# ----------------------------------------------------- #
-
-for line in (
-        "alter table ir_model_fields add group_name varchar(64)",
-        "alter table ir_model_fields add view_load boolean",
-        "alter table ir_model_fields alter group_name set default ''",
-        "alter table ir_model_fields alter view_load set default False",
-        "delete from ir_values where value like '%,False'",
-    ):
-    try:
-        cr.execute(line)
-    except psycopg.ProgrammingError, e:
-        cr.commit()
-        print e
-
-cr.commit()
-cr.close()
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed directory 'doc/migrate/3.4.0-4.0.0'
=== removed file 'doc/migrate/3.4.0-4.0.0/README'
--- doc/migrate/3.4.0-4.0.0/README	2006-12-28 11:58:44 +0000
+++ doc/migrate/3.4.0-4.0.0/README	1970-01-01 00:00:00 +0000
@@ -1,29 +0,0 @@
-This document describes the steps to follow to migrate from a version 3.4.0 of Tiny ERP server to a version 4.0.0
-
-Warning: the migration scripts involved in this migration are only meant for 
-a standard Tiny ERP installation. It might not work or even break some data 
-if you added or modified some code to the default Tiny ERP distribution.
-
-To migrate a 3.4.0 server to version 4.0.0 you should:
-
-- stop Tiny ERP server 3.4.0
-
-- backup your database
-	For example: pg_dump terp340 > backup340.sql
-
-- run the pre.py script (located in this directory)
-	You might need to pass it some optional arguments so that it can connect 
-	to the database.
-
-	For example: python pre.py -d terp340
-
-- run TinyERP server 4.0.0 with "-d terp340 -u all" in the parameters
-	For example: ./tinyerp-server.py -d terp340 -u all
-
-- stop TinyERP server 4.0.0
-
-- run the post.py script (located in this directory)
-	You might need to pass it some optional arguments so that it can connect 
-	to the database.
-
-- you are ready to work with the new version.

=== removed file 'doc/migrate/3.4.0-4.0.0/post-tiny.py'
--- doc/migrate/3.4.0-4.0.0/post-tiny.py	2010-06-21 09:05:43 +0000
+++ doc/migrate/3.4.0-4.0.0/post-tiny.py	1970-01-01 00:00:00 +0000
@@ -1,87 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Gaetan de Menten, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# --------------- #
-# remove old menu #
-# --------------- #
-
-cr.execute("delete from ir_ui_menu where (id not in (select parent_id from ir_ui_menu where parent_id is not null)) and (id not in (select res_id from ir_values where model='ir.ui.menu'))")
-cr.commit()
-
-# --------------- #
-# remove ir_value #
-# --------------- #
-
-cr.execute("delete from ir_values where model = 'ir.ui.menu' and res_id is null")
-cr.commit()
-
-cr.close()
-
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed file 'doc/migrate/3.4.0-4.0.0/post.py'
--- doc/migrate/3.4.0-4.0.0/post.py	2010-06-21 09:05:43 +0000
+++ doc/migrate/3.4.0-4.0.0/post.py	1970-01-01 00:00:00 +0000
@@ -1,116 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Gaetan de Menten, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ---------------------------------------------------------------- #
-# move user id from hr_analytic_timesheet to account_analytic_line #
-# ---------------------------------------------------------------- #
-
-cr.execute("UPDATE account_analytic_line SET user_id = hr_analytic_timesheet.user_id FROM hr_analytic_timesheet WHERE hr_analytic_timesheet.line_id = account_analytic_line.id")
-cr.commit()
-
-# --------------- #
-# remove old menu #
-# --------------- #
-
-while True:
-    cr.execute("select id from ir_ui_menu where (id not in (select parent_id from ir_ui_menu where parent_id is not null)) and (id not in (select res_id from ir_values where model='ir.ui.menu'))")
-    if not cr.rowcount:
-        break
-    cr.execute("delete from ir_ui_menu where (id not in (select parent_id from ir_ui_menu where parent_id is not null)) and (id not in (select res_id from ir_values where model='ir.ui.menu'))")
-cr.commit()
-
-# ----------------------------------------- #
-# add default value for discount in invoice #
-# ----------------------------------------- #
-
-cr.execute("update account_invoice_line set discount=0.0 where discount is null;")
-cr.commit()
-
-
-# -------------------------------------------------------------------------- #
-# update constraint account_invoice_line_uos_id_fkey on account_invoice_line #
-# -------------------------------------------------------------------------- #
-
-cr.execute("ALTER TABLE account_invoice_line DROP CONSTRAINT account_invoice_line_uos_id_fkey")
-cr.execute("ALTER TABLE account_invoice_line ADD FOREIGN KEY (uos_id) REFERENCES product_uom(id) ON DELETE SET NULL")
-cr.commit()
-
-print """
-WARNING: account_uos has been replaced by product_uom.
-It is not possible to migrate the data automatically so you need to create the old account_uos in the new product_uom.
-And then update the field uos_id of the table account_invoice to match the new id of product_uom.
-
-EXAMPLE:
-    UPDATE account_invoice SET uos_id = new_id WHERE uos_id = old_id;
-"""
-
-cr.close()
-
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed file 'doc/migrate/3.4.0-4.0.0/pre-tiny.py'
--- doc/migrate/3.4.0-4.0.0/pre-tiny.py	2009-10-20 10:52:23 +0000
+++ doc/migrate/3.4.0-4.0.0/pre-tiny.py	1970-01-01 00:00:00 +0000
@@ -1,145 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Gaetan de Menten, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ------------------------- #
-# change some columns types #
-# ------------------------- #
-
-def change_column(cr, table, column, new_type, copy):
-    commands = [
-        "ALTER TABLE %s RENAME COLUMN %s TO temp_column" % (table, column),
-        "ALTER TABLE %s ADD COLUMN %s %s" % (table, column, new_type),
-        "ALTER TABLE %s DROP COLUMN temp_column" % table
-    ]
-    if copy:
-        commands.insert(
-            2, 
-            "UPDATE %s SET %s=temp_column::%s" % (table, column, new_type))
-
-    for command in commands:
-        cr.execute(command)
-
-#change_column(cr, 'crm_case', 'date_closed', 'timestamp', True)
-cr.commit()
-
-# -------------------- #
-# add module if needed #
-# -------------------- #
-
-cr.execute("SELECT name FROM ir_module_module")
-if not cr.rowcount:
-    for module in set(['base', 'marketing', 'subscription', 'account', 'base_partner_relation', 'audittrail', 'account_followup', 'product', 'hr', 'l10n_simple', 'crm', 'stock', 'hr_timesheet', 'purchase', 'report_purchase', 'mrp', 'sale', 'report_sale', 'delivery', 'project', 'sale_crm', 'hr_timesheet_project', 'scrum', 'report_project',
-'account_followup',
-'account',
-'audittrail',
-'base_partner_relation',
-'crm',
-'delivery',
-'edi',
-'hr_evaluation',
-'hr_expense',
-'hr',
-'hr_timesheet_invoice',
-'hr_timesheet_project',
-'hr_timesheet',
-'l10n_simple',
-'marketing',
-'mrp',
-'network',
-'product',
-'project',
-'purchase',
-'report_crm',
-'report_project',
-'report_purchase',
-'report_sale',
-'sale_crm',
-'sale',
-'sandwich',
-'scrum',
-'stock']):
-        cr.execute("INSERT INTO ir_module_module (name, state) VALUES ('%s', 'installed')" % module)
-    cr.commit()
-
-
-# ----------------------------------------------------- #
-# add some fields (which cannot be added automatically) #
-# ----------------------------------------------------- #
-
-for line in (
-        "ALTER TABLE ir_module_module ADD demo BOOLEAN DEFAULT False",
-        "delete from ir_values where value like '%,False'",
-        """UPDATE ir_ui_view set arch='<?xml version="1.0"?><tree string="Menu" toolbar="1"><field icon="icon" name="name"/></tree>' where name='ir.ui.menu.tree' and type='tree' and field_parent='child_id'""",
-    ):
-    cr.execute(line)
-
-cr.commit()
-cr.close()
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed file 'doc/migrate/3.4.0-4.0.0/pre.py'
--- doc/migrate/3.4.0-4.0.0/pre.py	2010-06-21 09:05:43 +0000
+++ doc/migrate/3.4.0-4.0.0/pre.py	1970-01-01 00:00:00 +0000
@@ -1,127 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Gaetan de Menten, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ------------------------- #
-# change some columns types #
-# ------------------------- #
-
-def change_column(cr, table, column, new_type, copy):
-    commands = [
-        "ALTER TABLE %s RENAME COLUMN %s TO temp_column" % (table, column),
-        "ALTER TABLE %s ADD COLUMN %s %s" % (table, column, new_type),
-        "ALTER TABLE %s DROP COLUMN temp_column" % table
-    ]
-    if copy:
-        commands.insert(
-            2, 
-            "UPDATE %s SET %s=temp_column::%s" % (table, column, new_type))
-
-    for command in commands:
-        cr.execute(command)
-
-change_column(cr, 'crm_case', 'date_closed', 'timestamp', True)
-cr.commit()
-
-# -------------------- #
-# add module if needed #
-# -------------------- #
-
-cr.execute("SELECT name FROM ir_module_module")
-if not cr.rowcount:
-    for module in ('base', 'marketing', 'subscription', 'account', 'base_partner_relation', 'audittrail', 'account_followup', 'product', 'hr', 'l10n_simple', 'crm', 'stock', 'hr_timesheet', 'purchase', 'report_purchase', 'mrp', 'sale', 'report_sale', 'delivery', 'project', 'sale_crm', 'hr_timesheet_project', 'scrum', 'report_project'):
-        cr.execute("INSERT INTO ir_module_module (name, state) VALUES ('%s', 'installed')" % module)
-    cr.commit()
-
-# --------------- #
-# remove old menu #
-# --------------- #
-
-while True:
-    cr.execute("select id from ir_ui_menu where id not in (select parent_id from ir_ui_menu where parent_id is not null) and id not in (select res_id from ir_model_data where model='ir.ui.menu')")
-    if not cr.rowcount:
-        break
-    cr.execute("delete from ir_ui_menu where id not in (select parent_id from ir_ui_menu where parent_id is not null) and id not in (select res_id from ir_model_data where model='ir.ui.menu')")
-cr.commit()
-
-# ----------------------------------------------------- #
-# add some fields (which cannot be added automatically) #
-# ----------------------------------------------------- #
-
-for line in (
-        "ALTER TABLE ir_module_module ADD demo BOOLEAN",
-        "ALTER TABLE ir_module_module SET demo DEFAULT False",
-        "DELETE FROM ir_values WHERE VALUE LIKE '%,False'",
-        """UPDATE ir_ui_view set arch='<?xml version="1.0"?><tree string="Menu" toolbar="1"><field icon="icon" name="name"/></tree>' where name='ir.ui.menu.tree' and type='tree' and field_parent='child_id'""",
-    ):
-    cr.execute(line)
-
-cr.commit()
-cr.close()
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed directory 'doc/migrate/4.0.0-4.2.0'
=== removed file 'doc/migrate/4.0.0-4.2.0/pre.py'
--- doc/migrate/4.0.0-4.2.0/pre.py	2009-10-20 10:52:23 +0000
+++ doc/migrate/4.0.0-4.2.0/pre.py	1970-01-01 00:00:00 +0000
@@ -1,247 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Cédric Krier, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ------------------------ #
-# change currency rounding #
-# ------------------------ #
-
-cr.execute("""SELECT c.relname,a.attname,a.attlen,a.atttypmod,a.attnotnull,a.atthasdef,t.typname,CASE WHEN a.attlen=-1 THEN a.atttypmod-4 ELSE a.attlen END as size FROM pg_class c,pg_attribute a,pg_type t WHERE c.relname='res_currency' AND a.attname='rounding' AND c.oid=a.attrelid AND a.atttypid=t.oid""")
-res = cr.dictfetchall()
-if res[0]['typname'] != 'numeric':
-    for line in (
-        "ALTER TABLE res_currency RENAME rounding TO rounding_bak",
-        "ALTER TABLE res_currency ADD rounding NUMERIC(12,6)",
-        "UPDATE res_currency SET rounding = power(10, - rounding_bak)",
-        "ALTER TABLE res_currency DROP rounding_bak",
-        ):
-        cr.execute(line)
-cr.commit()
-
-# ----------------------------- #
-# drop constraint on ir_ui_view #
-# ----------------------------- #
-
-cr.execute('SELECT conname FROM pg_constraint where conname = \'ir_ui_view_type\'')
-if cr.fetchall():
-    cr.execute('ALTER TABLE ir_ui_view DROP CONSTRAINT ir_ui_view_type')
-cr.commit()
-
-# ------------------------ #
-# update res.partner.bank  #
-# ------------------------ #
-
-cr.execute('SELECT a.attname FROM pg_class c, pg_attribute a WHERE c.relname = \'res_partner_bank\' AND a.attname = \'iban\' AND c.oid = a.attrelid')
-if cr.fetchall():
-    cr.execute('ALTER TABLE res_partner_bank RENAME iban TO acc_number')
-cr.commit()
-
-# ------------------------------------------- #
-# Add perm_id to ir_model and ir_model_fields #
-# ------------------------------------------- #
-
-cr.execute('SELECT a.attname FROM pg_class c, pg_attribute a WHERE c.relname = \'ir_model\' AND a.attname = \'perm_id\' AND c.oid = a.attrelid')
-if not cr.fetchall():
-    cr.execute("ALTER TABLE ir_model ADD perm_id int references perm on delete set null")
-cr.commit()
-
-cr.execute('SELECT a.attname FROM pg_class c, pg_attribute a WHERE c.relname = \'ir_model_fields\' AND a.attname = \'perm_id\' AND c.oid = a.attrelid')
-if not cr.fetchall():
-    cr.execute("ALTER TABLE ir_model_fields ADD perm_id int references perm on delete set null")
-cr.commit()
-
-
-# --------------------------------- #
-# remove name for all ir_act_window #
-# --------------------------------- #
-
-cr.execute("UPDATE ir_act_window SET name = ''")
-cr.commit()
-
-# ------------------------------------------------------------------------ #
-# Create a "allow none" default access to keep the behaviour of the system #
-# ------------------------------------------------------------------------ #
-
-cr.execute('SELECT model_id FROM ir_model_access')
-res= cr.fetchall()
-for r in res:
-    cr.execute('SELECT id FROM ir_model_access WHERE model_id = %d AND group_id IS NULL', (r[0],))
-    if not cr.fetchall():
-        cr.execute("INSERT into ir_model_access (name,model_id,group_id) VALUES ('Auto-generated access by migration',%d,NULL)",(r[0],))
-cr.commit()
-
-# ------------------------------------------------- #
-# Drop view report_account_analytic_line_to_invoice #
-# ------------------------------------------------- #
-
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_account_analytic_line_to_invoice\'')
-if cr.fetchall():
-    cr.execute('DROP VIEW report_account_analytic_line_to_invoice')
-cr.commit()
-
-# --------------------------- #
-# Drop state from hr_employee #
-# --------------------------- #
-
-cr.execute('SELECT * FROM pg_class c, pg_attribute a WHERE c.relname=\'hr_employee\' AND a.attname=\'state\' AND c.oid=a.attrelid')
-if cr.fetchall():
-    cr.execute('ALTER TABLE hr_employee DROP state')
-cr.commit()
-
-# ------------ #
-# Add timezone #
-# ------------ #
-
-cr.execute('SELECT id FROM ir_values where model=\'res.users\' AND key=\'meta\' AND name=\'tz\'')
-if not cr.fetchall():
-    import pytz, pickle
-    meta = pickle.dumps({'type':'selection', 'string':'Timezone', 'selection': [(x, x) for x in pytz.all_timezones]})
-    value = pickle.dumps(False)
-    cr.execute('INSERT INTO ir_values (name, key, model, meta, key2, object, value) VALUES (\'tz\', \'meta\', \'res.users\', %s, \'tz\', %s, %s)', (meta,False, value))
-cr.commit()
-
-# ------------------------- #
-# change product_uom factor #
-# ------------------------- #
-
-cr.execute('SELECT a.attname FROM pg_class c, pg_attribute a, pg_type t WHERE c.relname = \'product_uom\' AND a.attname = \'factor\' AND c.oid = a.attrelid AND a.atttypid = t.oid AND t.typname = \'float8\'')
-if cr.fetchall():
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_account_analytic_planning_stat_account\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_account_analytic_planning_stat_account')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_account_analytic_planning_stat\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_account_analytic_planning_stat')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_account_analytic_planning_stat_user\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_account_analytic_planning_stat_user')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_purchase_order_product\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_purchase_order_product')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_purchase_order_category\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_purchase_order_category')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_sale_order_product\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_sale_order_product')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_sale_order_category\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_sale_order_category')
-    cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_hr_timesheet_invoice_journal\'')
-    if cr.fetchall():
-        cr.execute('DROP VIEW report_hr_timesheet_invoice_journal')
-
-    cr.execute('ALTER TABLE product_uom RENAME COLUMN factor to temp_column')
-    cr.execute('ALTER TABLE product_uom ADD COLUMN factor NUMERIC(12,6)')
-    cr.execute('UPDATE product_uom SET factor = temp_column')
-    cr.execute('ALTER TABLE product_uom ALTER factor SET NOT NULL')
-    cr.execute('ALTER TABLE product_uom DROP COLUMN temp_column')
-cr.commit()
-
-
-# ------------------------------------------------- #
-# Drop name_uniq constraint on stock_production_lot #
-# ------------------------------------------------- #
-
-cr.execute('SELECT conname FROM pg_constraint where conname = \'stock_production_lot_name_uniq\'')
-if cr.fetchall():
-    cr.execute('ALTER TABLE stock_production_lot DROP CONSTRAINT stock_production_lot_name_uniq')
-cr.commit()
-
-# ------------------------------------ #
-# Put country/state code in upper case #
-# ------------------------------------ #
-
-cr.execute('UPDATE res_country SET code = UPPER(code)')
-cr.execute('UPDATE res_country_state SET code = UPPER(code)')
-cr.commit()
-
-# --------------------------------------------- #
-# Add primary key on tables inherits ir_actions #
-# --------------------------------------------- #
-
-cr.execute('SELECT indexname FROm pg_indexes WHERE indexname = \'ir_act_report_xml_pkey\' and tablename = \'ir_act_report_xml\'')
-if not cr.fetchall():
-    cr.execute('ALTER TABLE ir_act_report_xml ADD PRIMARY KEY (id)')
-cr.execute('SELECT indexname FROm pg_indexes WHERE indexname = \'ir_act_report_custom_pkey\' and tablename = \'ir_act_report_custom\'')
-if not cr.fetchall():
-    cr.execute('ALTER TABLE ir_act_report_custom ADD PRIMARY KEY (id)')
-cr.execute('SELECT indexname FROm pg_indexes WHERE indexname = \'ir_act_group_pkey\' and tablename = \'ir_act_group\'')
-if not cr.fetchall():
-    cr.execute('ALTER TABLE ir_act_group ADD PRIMARY KEY (id)')
-cr.execute('SELECT indexname FROm pg_indexes WHERE indexname = \'ir_act_execute_pkey\' and tablename = \'ir_act_execute\'')
-if not cr.fetchall():
-    cr.execute('ALTER TABLE ir_act_execute ADD PRIMARY KEY (id)')
-cr.execute('SELECT indexname FROm pg_indexes WHERE indexname = \'ir_act_wizard_pkey\' and tablename = \'ir_act_wizard\'')
-if not cr.fetchall():
-    cr.execute('ALTER TABLE ir_act_wizard ADD PRIMARY KEY (id)')
-cr.commit()
-
-cr.close
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed directory 'doc/migrate/4.0.0-4.2.0/tiny'
=== removed file 'doc/migrate/4.0.0-4.2.0/tiny/README'
--- doc/migrate/4.0.0-4.2.0/tiny/README	2007-10-05 13:31:17 +0000
+++ doc/migrate/4.0.0-4.2.0/tiny/README	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-Those scripts are provide as example of customization of migration scripts

=== removed file 'doc/migrate/4.0.0-4.2.0/tiny/pre-tiny.py'
--- doc/migrate/4.0.0-4.2.0/tiny/pre-tiny.py	2010-06-21 09:05:43 +0000
+++ doc/migrate/4.0.0-4.2.0/tiny/pre-tiny.py	1970-01-01 00:00:00 +0000
@@ -1,188 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__author__ = 'Cédric Krier, <[e-mail]>'
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-raise Exception('This script is provided as an example, you must custom it before')
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# fix country
-
-
-cr.execute('SELECT code from res_country where code is not null group by code')
-res = cr.fetchall()
-
-for c in res:
-    cr.execute('SELECT max(id) from res_country where code = %s group by code', (c[0],))
-    res2 = cr.fetchone()
-    cr.execute('SELECT id from res_country where code = %s', (c[0],))
-    ids = ','.join(map(lambda x: str(x[0]), cr.fetchall()))
-    cr.execute('UPDATE res_partner_address set country_id = %d where country_id in ('+ids+')', (res2[0],))
-    cr.execute('DELETE FROM res_country WHERE code = %s and id <> %d', (c[0], res2[0],))
-cr.commit()
-
-
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_account_analytic_planning_stat\'')
-if cr.fetchall():
-    cr.execute('DROP VIEW report_account_analytic_planning_stat')
-cr.commit()
-
-
-cr.execute('SELECT name from ( SELECT name, count(name) AS n FROM res_partner GROUP BY name ) AS foo WHERE n > 1')
-res = cr.fetchall()
-
-
-for p in res:
-    cr.execute('SELECT max(id) FROM res_partner WHERE name = %s GROUP BY name', (p[0],))
-    res2 = cr.fetchone()
-    cr.execute('UPDATE res_partner set active = False WHERE name = %s and id <> %d', (p[0], res2[0],))
-    cr.execute('SELECT id FROM res_partner WHERE name = %s AND id <> %d', (p[0], res2[0],))
-    res3 = cr.fetchall()
-    i = 0
-    for id in res3:
-        name = p[0]+' old'
-        if i:
-            name = name + ' ' + str(i)
-        cr.execute('UPDATE res_partner set name = %s WHERE id = %d', (name, id[0]))
-        i += 1
-cr.commit()
-
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_account_analytic_line_to_invoice\'')
-if cr.fetchall():
-    cr.execute('DROP VIEW report_account_analytic_line_to_invoice')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_timesheet_invoice\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_timesheet_invoice')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_purchase_order_category\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_purchase_order_category')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_purchase_order_product\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_purchase_order_product')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_sale_order_category\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_sale_order_category')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_sale_order_product\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_sale_order_product')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_timesheet_user\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_timesheet_user')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'report_task_user_pipeline_open\'')
-if cr.fetchall():
-    cr.execute('drop VIEW report_task_user_pipeline_open')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'hr_timesheet_sheet_sheet_day\'')
-if cr.fetchall():
-    cr.execute('drop VIEW hr_timesheet_sheet_sheet_day')
-cr.execute('SELECT viewname FROM pg_views WHERE viewname = \'hr_timesheet_sheet_sheet_account\'')
-if cr.fetchall():
-    cr.execute('drop VIEW hr_timesheet_sheet_sheet_account')
-cr.execute('SELECT viewname from pg_views where viewname = \'sale_journal_sale_stats\'')
-if cr.fetchall():
-    cr.execute('drop VIEW sale_journal_sale_stats')
-cr.execute('SELECT viewname from pg_views where viewname = \'sale_journal_picking_stats\'')
-if cr.fetchall():
-    cr.execute('drop VIEW sale_journal_picking_stats')
-cr.execute('SELECT viewname from pg_views where viewname = \'sale_journal_invoice_type_stats\'')
-if cr.fetchall():
-    cr.execute('drop VIEW sale_journal_invoice_type_stats')
-
-cr.execute('ALTER TABLE product_template ALTER list_price TYPE numeric(16,2)')
-cr.execute('ALTER TABLE product_template ALTER standard_price TYPE numeric(16,2)')
-cr.execute('ALTER TABLE product_product ALTER price_extra TYPE numeric(16,2)')
-cr.execute('ALTER TABLE product_product ALTER price_margin TYPE numeric(16,2)')
-cr.execute('ALTER TABLE pricelist_partnerinfo ALTER price TYPE numeric(16,2)')
-cr.execute('ALTER TABLE account_invoice_line ALTER price_unit TYPE numeric(16,2)')
-cr.execute('ALTER TABLE purchase_order_line ALTER price_unit TYPE numeric(16,2)')
-cr.execute('ALTER TABLE sale_order_line ALTER price_unit TYPE numeric(16,2)')
-cr.commit()
-
-
-cr.execute('SELECT tablename FROM pg_tables WHERE tablename = \'subscription_document_fields\'')
-if cr.fetchall():
-    cr.execute('DROP TABLE subscription_document_fields')
-cr.execute('SELECT tablename FROM pg_tables WHERE tablename = \'subscription_document\'')
-if cr.fetchall():
-    cr.execute('DROP TABLE subscription_document')
-cr.execute('SELECT tablename FROM pg_tables WHERE tablename = \'subscription_subscription_history\'')
-if cr.fetchall():
-    cr.execute('DROP TABLE subscription_subscription_history')
-cr.commit()
-
-# -------------------- #
-# Change currency rate #
-# -------------------- #
-
-cr.execute('SELECT a.attname FROM pg_class c, pg_attribute a WHERE c.relname = \'res_currency_rate\' AND a.attname = \'rate_old\' AND c.oid = a.attrelid')
-if not cr.fetchall():
-    cr.execute('ALTER TABLE res_currency_rate ADD rate_old NUMERIC(12,6)')
-    cr.execute('UPDATE res_currency_rate SET rate_old = rate')
-    cr.execute('UPDATE res_currency_rate SET rate = (1 / rate_old)')
-cr.commit()
-
-cr.close
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== removed directory 'doc/migrate/4.2.0-4.4.0'
=== removed file 'doc/migrate/4.2.0-4.4.0/pre.py'
--- doc/migrate/4.2.0-4.4.0/pre.py	2009-10-20 10:52:23 +0000
+++ doc/migrate/4.2.0-4.4.0/pre.py	1970-01-01 00:00:00 +0000
@@ -1,110 +0,0 @@
-# -*- coding: utf-8 -*-
-##############################################################################
-#    
-#    OpenERP, Open Source Management Solution
-#    Copyright (C) 2004-2009 Tiny SPRL (<http://tiny.be>).
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as
-#    published by the Free Software Foundation, either version 3 of the
-#    License, or (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <http://www.gnu.org/licenses/>.     
-#
-##############################################################################
-
-__version__ = '0.1.0'
-
-import psycopg
-import optparse
-import ConfigParser
-
-# -----
-
-parser = optparse.OptionParser(version="Tiny ERP server migration script " + __version__)
-
-parser.add_option("-c", "--config", dest="config", help="specify path to Tiny ERP config file")
-
-group = optparse.OptionGroup(parser, "Database related options")
-group.add_option("--db_host", dest="db_host", help="specify the database host") 
-group.add_option("--db_port", dest="db_port", help="specify the database port") 
-group.add_option("-d", "--database", dest="db_name", help="specify the database name")
-group.add_option("-r", "--db_user", dest="db_user", help="specify the database user name")
-group.add_option("-w", "--db_password", dest="db_password", help="specify the database password") 
-parser.add_option_group(group)
-
-options = optparse.Values()
-options.db_name = 'terp' # default value
-parser.parse_args(values=options)
-
-if hasattr(options, 'config'):
-    configparser = ConfigParser.ConfigParser()
-    configparser.read([options.config])
-    for name, value in configparser.items('options'):
-        if not (hasattr(options, name) and getattr(options, name)):
-            if value in ('true', 'True'):
-                value = True
-            if value in ('false', 'False'):
-                value = False
-            setattr(options, name, value)
-
-# -----
-
-host = hasattr(options, 'db_host') and "host=%s" % options.db_host or ''
-port = hasattr(options, 'db_port') and "port=%s" % options.db_port or ''
-name = "dbname=%s" % options.db_name
-user = hasattr(options, 'db_user') and "user=%s" % options.db_user or ''
-password = hasattr(options, 'db_password') and "password=%s" % options.db_password or ''
-
-db = psycopg.connect('%s %s %s %s %s' % (host, port, name, user, password), serialize=0)
-cr = db.cursor()
-
-# ------------------------------ #
-# drop not null on ir_attachment #
-# ------------------------------ #
-
-cr.execute('ALTER TABLE ir_attachment \
-        ALTER COLUMN res_model DROP NOT NULL, \
-        ALTER COLUMN res_id DROP NOT NULL')
-cr.commit()
-
-# ---------------------------------- #
-# change case date_deadline rounding #
-# ---------------------------------- #
-
-cr.execute("""SELECT
-c.relname,a.attname,a.attlen,a.atttypmod,a.attnotnull,a.atthasdef,t.typname,CASE
-WHEN a.attlen=-1 THEN a.atttypmod-4 ELSE a.attlen END as size FROM pg_class
-c,pg_attribute a,pg_type t WHERE c.relname='crm_case' AND
-a.attname='date_deadline' AND c.oid=a.attrelid AND a.atttypid=t.oid""")
-
-res = cr.dictfetchall()
-if res[0]['typname'] != 'timestamp':
-    for line in (
-        "ALTER TABLE crm_case RENAME date_deadline TO date_deadline_bak",
-        "ALTER TABLE crm_case ADD date_deadline timestamp",
-        "UPDATE crm_case SET date_deadline = date_deadline_bak",
-        "ALTER TABLE crm_case DROP date_deadline_bak",
-        ):
-        cr.execute(line)
-cr.commit()
-
-cr.execute('drop view report_task_user_pipeline_open');
-cr.commit()
-
-cr.execute('alter table ir_model_fields add state varchar(26)')
-cr.execute('alter table ir_model_fields add select_level varchar(3)')
-cr.execute('alter table ir_act_wizard add primary key(id)')
-cr.commit()
-
-
-cr.close()
-
-# vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-

=== added file 'tools/find_sql_injection.py'
--- tools/find_sql_injection.py	1970-01-01 00:00:00 +0000
+++ tools/find_sql_injection.py	2017-10-06 09:59:17 +0000
@@ -0,0 +1,173 @@
+#!/usr/bin/env python
+
+# original code from https://github.com/uber/py-find-injection
+
+import argparse
+import ast
+import sys
+import os
+import re
+import linecache
+import glob
+
+version_info = (0, 1, 1)
+__version__ = '.'.join(map(str, version_info))
+
+
+def stringify(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    elif isinstance(node, ast.Attribute):
+        return '%s.%s' % (stringify(node.value), node.attr)
+    elif isinstance(node, ast.Subscript):
+        return '%s[%s]' % (stringify(node.value), stringify(node.slice))
+    elif isinstance(node, ast.Index):
+        return stringify(node.value)
+    elif isinstance(node, ast.Call):
+        return '%s(%s, %s)' % (stringify(node.func), stringify(node.args), stringify(node.keywords))
+    elif isinstance(node, list):
+        return '[%s]' % (', '.join(stringify(n) for n in node))
+    elif isinstance(node, ast.Str):
+        return node.s
+    else:
+        return ast.dump(node)
+
+
+class IllegalLine(object):
+    def __init__(self, reason, node, filename):
+        self.reason = reason
+        self.lineno = node.lineno
+        self.filename = filename
+        self.node = node
+
+    def __str__(self):
+        return "%s:%d\t%s" % (self.filename, self.lineno, self.reason)
+
+    def __repr__(self):
+        return "IllegalLine<%s, %s:%s>" % (self.reason, self.filename, self.lineno)
+
+
+def find_assignment_in_context(variable, context):
+    if isinstance(context, (ast.FunctionDef, ast.Module, ast.For, ast.While, ast.With, ast.If)):
+        for node in reversed(list(ast.iter_child_nodes(context))):
+            if isinstance(node, ast.Assign):
+                if variable in (stringify(c) for c in node.targets):
+                    return node
+    if getattr(context, 'parent', None):
+        return find_assignment_in_context(variable, context.parent)
+    else:
+        return None
+
+
+class Checker(ast.NodeVisitor):
+    def __init__(self, filename, *args, **kwargs):
+        self.filename = filename
+        self.errors = []
+        super(Checker, self).__init__(*args, **kwargs)
+
+    def ignore_sql_check(self, line_number):
+        file_text_line = linecache.getline(self.filename, line_number)
+        res = re.search('  # (.*)', file_text_line)
+        if res and (res.group(1).startswith('ignore_sql_check') or
+                res.group(1).startswith('not_a_user_entry')):
+            return True
+        else:
+            return False
+
+
+    def check_execute(self, node):
+        if isinstance(node, ast.BinOp):
+            if isinstance(node.op, ast.Mod):
+                if not self.ignore_sql_check(node.lineno):
+                    return IllegalLine('string interpolation of SQL query', node, self.filename)
+            elif isinstance(node.op, ast.Add):
+                if not self.ignore_sql_check(node.lineno):
+                    return IllegalLine('string concatenation of SQL query', node, self.filename)
+        elif isinstance(node, ast.Call):
+            if isinstance(node.func, ast.Attribute):
+                if node.func.attr == 'format':
+                    if not self.ignore_sql_check(node.lineno):
+                        return IllegalLine('str.format called on SQL query', node, self.filename)
+        elif isinstance(node, ast.Name):
+            # now we need to figure out where that query is assigned. blargh.
+            assignment = find_assignment_in_context(node.id, node)
+            if assignment is not None:
+                return self.check_execute(assignment.value)
+
+    def visit_Call(self, node):
+        function_name = stringify(node.func)
+        if function_name.lower() in ('cr.execute', 'cursor.execute'):
+            node.args[0].parent = node
+            node_error = self.check_execute(node.args[0])
+            if node_error:
+                self.errors.append(node_error)
+        #elif function_name.lower() == 'eval':
+        #    self.errors.append(IllegalLine('eval() is just generally evil', node, self.filename))
+        self.generic_visit(node)
+
+    def visit(self, node):
+        """Visit a node."""
+        method = 'visit_' + node.__class__.__name__
+        visitor = getattr(self, method, self.generic_visit)
+        return visitor(node)
+
+    def generic_visit(self, node):
+        """Called if no explicit visitor function exists for a node."""
+        for field, value in ast.iter_fields(node):
+            if isinstance(value, list):
+                for item in value:
+                    if isinstance(item, ast.AST):
+                        item.parent = node
+                        self.visit(item,)
+            elif isinstance(value, ast.AST):
+                value.parent = node
+                self.visit(value)
+
+
+def check(filename):
+    c = Checker(filename=filename)
+    with open(filename, 'r') as fobj:
+        try:
+            parsed = ast.parse(fobj.read(), filename)
+            c.visit(parsed)
+        except Exception:
+            raise
+    return c.errors
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description='Look for patterns in python source files that might indicate SQL injection vulnerabilities',
+        epilog='Exit status is 0 if all files are okay, 1 if any files have an error. Errors are printed to stdout'
+    )
+    parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
+    parser.add_argument('files', nargs='+', help='file(s) or folder(s) to check. Folders are scanned recursivly.')
+    args = parser.parse_args()
+
+    errors = []
+    file_list = []
+    for fname in args.files:
+        if not os.path.exists(fname):
+            errors.extend('%s don\'t exists' % fname)
+        if os.path.isdir(fname):
+            for root, directories, filenames in os.walk(fname):
+                for filename in filenames:
+                    if filename.endswith('.py'):
+                        file_list.append(os.path.join(root,filename))
+        elif os.path.isfile(fname):
+            file_list.append(fname)
+
+    for fname in file_list:
+        these_errors = check(fname)
+        if these_errors:
+            print '\n'.join(str(e) for e in these_errors)
+            errors.extend(these_errors)
+    if errors:
+        print '%d total errors' % len(errors)
+        return 1
+    else:
+        return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())