Merge pull request #127 from gurneyalex/9.0

[SEC] account_invoice_validation_workflow: fix unsafe eval
OCA · Feb 15, 2016 · edf1f2e · edf1f2e
2 parents 0c14e54 + e8a857a
commit edf1f2e
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/account_invoice_validation_workflow/__openerp__.py b/account_invoice_validation_workflow/__openerp__.py
@@ -20,7 +20,7 @@
 ##############################################################################
 {
     'name': 'Add "To Send" and "To Validate" states in Invoices',
-    'version': '8.0.1.0.0',
+    'version': '8.0.1.0.1',
     'category': 'Generic Modules/Invoicing',
     'description':
     '''

diff --git a/account_invoice_validation_workflow/invoice.py b/account_invoice_validation_workflow/invoice.py
@@ -21,6 +21,7 @@
 from openerp import models, fields, api, exceptions
 from openerp.osv import orm
 from openerp.tools.translate import _
+from openerp.tools.safe_eval import safe_eval
 from openerp import netsvc
 
 
@@ -228,7 +229,7 @@ def compute_refund(self, cr, uid, ids, mode='refund', context=None):
             result = mod_obj.get_object_reference(cr, uid, 'account', xml_id)
             id = result and result[1] or False
             result = act_obj.read(cr, uid, id, context=context)
-            invoice_domain = eval(result['domain'])
+            invoice_domain = safe_eval(result['domain'])
             invoice_domain.append(('id', 'in', created_inv))
             result['domain'] = invoice_domain
             return result