0041258: PaymentReportDao is not using bind-param - Openbravo Issue Tracking System

Openbravo Issue Tracking System - Openbravo ERP

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0041258

Openbravo ERP

09. Financial management

public

2019-06-27 18:09

2019-07-16 16:42

Reporter

shuehner

Assigned To

Triage Omni OMS

Priority

normal

Severity

major

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

3.0PR19Q3

Fixed in Version

3.0PR19Q3

Merge Request Status

Review Assigned To

dmiguelez

OBNetwork customer

Web browser

Modules

Core

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0041258: PaymentReportDao is not using bind-param

Description

Several cases in that file are not using bind-param both for simple values i.e. here:
          hsqlScript.append(" and fpsd.");
          hsqlScript.append(FIN_PaymentScheduleDetail.PROPERTY_ORGANIZATION);
          hsqlScript.append(".id = '");
          hsqlScript.append(strOrg);
          hsqlScript.append("'");

as well as for list of values in in-clauses:
          hsqlScript.append(".id in ('");
          Set<String> orgChildTree = OBContext.getOBContext()
              .getOrganizationStructureProvider()
              .getChildTree(strOrg, true);
          Iterator<String> orgChildTreeIter = orgChildTree.iterator();
          while (orgChildTreeIter.hasNext()) {
            hsqlScript.append(orgChildTreeIter.next());
            orgChildTreeIter.remove();
            hsqlScript.append("'");
            if (orgChildTreeIter.hasNext()) {
              hsqlScript.append(", '");
            }
          }
          hsqlScript.append(")");
        }

Note: that setParameterList can be easily use to pass value lists directly see issue 40580 for an example

Steps To Reproduce

Proposed Solution

Additional Information