0038142: pl-function ad_get_doc_le_bu is not using bind-parameters

Description

That function is creating dynamic sql and embedding values into sql-text:

  EXECUTE IMMEDIATE
    'SELECT ad_org.ad_org_id, ad_orgtype.isbusinessunit, ad_orgtype.islegalentity
     FROM '||p_header_table||', ad_org, ad_orgtype
     WHERE '||p_header_table||'.'||p_header_column_id||' = '''||p_document_id||'''
     AND ad_org.ad_orgtype_id = ad_orgtype.ad_orgtype_id
     AND '||p_header_table||'.ad_org_id=ad_org.ad_org_id '
    INTO v_org_header_id, v_isbusinessunit, v_islegalentity;

Steps To Reproduce

Tags

No tags attached.

Attached Files

Relationships [ Relation Graph ] [ Dependency Graph ]

blocks

design defect

0038136

acknowledged

Triage Platform Base

Tracking issue: Find & Fix queries not using bind-params but embedding values into query string

Notes
(0103241) shuehner (administrator) 2018-03-14 15:25	Note: That being in pl-code unclear if the b.2 reason from the tracking issue applies equally in this case.

(0103244) shuehner (administrator) 2018-03-14 15:50	Checking usage of this pl 3 distinct cases: a.) from java-code FIN_Utility.periodControlOpened (which is bad naming anyway) b.) from other pl-functions (_POST + _PROCESS) c.) from 2 pl-functions defined in postscripts At least for a.) it should be possible to easily do the same check in java without any pl call.

Issue History
Date Modified	Username	Field	Change
2018-03-14 15:20	shuehner	New Issue
2018-03-14 15:20	shuehner	Assigned To	=> Triage Finance
2018-03-14 15:20	shuehner	Modules	=> Core
2018-03-14 15:20	shuehner	Triggers an Emergency Pack	=> No
2018-03-14 15:24	shuehner	Relationship added	blocks 0038136
2018-03-14 15:25	shuehner	Note Added: 0103241
2018-03-14 15:50	shuehner	Note Added: 0103244