Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0038142Openbravo ERP09. Financial managementpublic2018-03-14 15:202018-03-14 15:50
Reportershuehner 
Assigned ToTriage Omni OMS 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusnewResolutionopen 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0038142: pl-function ad_get_doc_le_bu is not using bind-parameters
DescriptionThat function is creating dynamic sql and embedding values into sql-text:

  EXECUTE IMMEDIATE
    'SELECT ad_org.ad_org_id, ad_orgtype.isbusinessunit, ad_orgtype.islegalentity
     FROM '||p_header_table||', ad_org, ad_orgtype
     WHERE '||p_header_table||'.'||p_header_column_id||' = '''||p_document_id||'''
     AND ad_org.ad_orgtype_id = ad_orgtype.ad_orgtype_id
     AND '||p_header_table||'.ad_org_id=ad_org.ad_org_id '
    INTO v_org_header_id, v_isbusinessunit, v_islegalentity;
Steps To Reproduce-
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
blocks design defect 0038136 acknowledged Triage Platform Base Tracking issue: Find & Fix queries not using bind-params but embedding values into query string 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2018-03-14 15:20shuehnerNew Issue
2018-03-14 15:20shuehnerAssigned To => Triage Finance
2018-03-14 15:20shuehnerModules => Core
2018-03-14 15:20shuehnerTriggers an Emergency Pack => No
2018-03-14 15:24shuehnerRelationship addedblocks 0038136
2018-03-14 15:25shuehnerNote Added: 0103241
2018-03-14 15:50shuehnerNote Added: 0103244

Notes
(0103241)
shuehner   
2018-03-14 15:25   
Note: That being in pl-code unclear if the b.2 reason from the tracking issue applies equally in this case.
(0103244)
shuehner   
2018-03-14 15:50   
Checking usage of this pl 3 distinct cases:
a.) from java-code FIN_Utility.periodControlOpened (which is bad naming anyway)
b.) from other pl-functions (*_POST + *_PROCESS)
c.) from 2 pl-functions defined in postscripts

At least for a.) it should be possible to easily do the same check in java without any pl call.