Merge pull request #44 from gurneyalex/9.0-unsafe-eval

[SEC] report_xls: fix unsafe eval
OCA · Feb 15, 2016 · 1fa32b2 · 1fa32b2
2 parents 92509d8 + 32b4e8c
commit 1fa32b2
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/report_xls/__openerp__.py b/report_xls/__openerp__.py
@@ -21,7 +21,7 @@
 ##############################################################################
 {
     'name': 'Excel report engine',
-    'version': '8.0.0.6.0',
+    'version': '8.0.0.6.1',
     'license': 'AGPL-3',
     'author': "Noviat,Odoo Community Association (OCA)",
     'website': 'http://www.noviat.com',

diff --git a/report_xls/report_xls.py b/report_xls/report_xls.py
@@ -26,6 +26,7 @@
 from datetime import datetime
 from openerp.osv.fields import datetime as datetime_field
 from openerp.tools import DEFAULT_SERVER_DATETIME_FORMAT
+from openerp.tools.safe_eval import safe_eval
 import inspect
 from types import CodeType
 from openerp.report.report_sxw import report_sxw
@@ -160,7 +161,7 @@ def render(self, wanted, col_specs, rowtype, render_space='empty'):
         row = col_specs[wanted][rowtype][:]
         for i in range(len(row)):
             if isinstance(row[i], CodeType):
-                row[i] = eval(row[i], render_space)
+                row[i] = safe_eval(row[i], render_space)
         row.insert(0, wanted)
         return row