0040715: POSUtils.getPriceListVersionForPriceList is not using bind-parameters

Openbravo Issue Tracking System - Retail Modules

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0040715

Retail Modules

Web POS

public

2019-04-10 12:47

2019-05-02 08:31

Reporter

shuehner

Assigned To

ranjith_qualiantech_com

Priority

normal

Severity

major

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

RR19Q1.1

Fixed in Version

RR19Q1.1

Merge Request Status

Review Assigned To

marvintm

OBNetwork customer

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0040715: POSUtils.getPriceListVersionForPriceList is not using bind-parameters

Description

This code is not using bind-params:

      Query<PriceListVersion> priceListVersionQuery = OBDal.getInstance()
          .getSession()
          .createQuery("from PricingPriceListVersion AS plv " + "where plv.priceList.id ='"
              + priceListId
              + "' and plv.active=true and plv.validFromDate = (select max(pplv.validFromDate) "
              + "from PricingPriceListVersion as pplv where pplv.active=true and pplv.priceList.id = '"
              + priceListId + "' and to_char(pplv.validFromDate,'yyyy-mm-dd') <= '"
              + format.format(terminalDate) + "' )", PriceListVersion.class);
      for (PriceListVersion plv : priceListVersionQuery.list()) {
        return plv;
      }

Steps To Reproduce

Proposed Solution

Additional Information