[FIX] replace string formatted sql statements

database_cleanup/identifier_adapter.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+# © 2016 Therp BV <http://therp.nl>
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html).
+from psycopg2.extensions import ISQLQuote
+
+
+class IdentifierAdapter(ISQLQuote):
+    def __init__(self, identifier, quote=True):
+        self.quote = quote
+        self.identifier = identifier
+
+    def __conform__(self, protocol):
+        if protocol == ISQLQuote:
+            return self
+
+    def getquoted(self):
+        def is_identifier_char(c):
+            return c.isalnum() or c in ['_', '$']
+
+        format_string = '"%s"'
+        if not self.quote:
+            format_string = '%s'
+        return format_string % filter(is_identifier_char, self.identifier)

database_cleanup/model/purge_columns.py

@@ -21,6 +21,7 @@
 
 from openerp.osv import orm, fields
 from openerp.tools.translate import _
+from ..identifier_adapter import IdentifierAdapter
 
 
 class CleanupPurgeLineColumn(orm.TransientModel):
@@ -61,9 +62,11 @@ class CleanupPurgeLineColumn(orm.TransientModel):
                 'Dropping column %s from table %s',
                 line.name, model_pool._table)
             cr.execute(
-                """
-                ALTER TABLE "%s" DROP COLUMN "%s"
-                """ % (model_pool._table, line.name))
+                "ALTER TABLE %s DROP COLUMN %s",
+                (
+                    IdentifierAdapter(model_pool._table),
+                    IdentifierAdapter(line.name),
+                ))
             line.write({'purged': True})
             cr.commit()
         return True

database_cleanup/model/purge_data.py

@@ -21,6 +21,7 @@
 
 from openerp.osv import orm, fields
 from openerp.tools.translate import _
+from ..identifier_adapter import IdentifierAdapter
 
 
 class CleanupPurgeLineData(orm.TransientModel):
@@ -80,11 +81,11 @@ class CleanupPurgeWizardData(orm.TransientModel):
             cr.execute(
                 """
                 SELECT id FROM ir_model_data
-                WHERE model = %%s
+                WHERE model = %s
                 AND res_id IS NOT NULL
                 AND NOT EXISTS (
                     SELECT id FROM %s WHERE id=ir_model_data.res_id)
-                """ % self.pool[model]._table, (model,))
+                """, (model, IdentifierAdapter(self.pool[model]._table)))
             data_ids += [data_row[0] for data_row in cr.fetchall()]
         data_ids += data_pool.search(
             cr, uid, [('model', 'in', unknown_models)], context=context)

database_cleanup/model/purge_tables.py

@@ -21,6 +21,7 @@
 
 from openerp.osv import orm, fields
 from openerp.tools.translate import _
+from ..identifier_adapter import IdentifierAdapter
 
 
 class CleanupPurgeLineTable(orm.TransientModel):
@@ -62,7 +63,7 @@ class CleanupPurgeLineTable(orm.TransientModel):
                 WHERE af.attnum = confkey AND af.attrelid = confrelid AND
                 a.attnum = conkey AND a.attrelid = conrelid
                 AND confrelid::regclass = '%s'::regclass;
-                """ % line.name)
+                """, (IdentifierAdapter(line.name, quote=False),))
 
             for constraint in cr.fetchall():
                 if constraint[3] in tables:
@@ -70,12 +71,15 @@ class CleanupPurgeLineTable(orm.TransientModel):
                         'Dropping constraint %s on table %s (to be dropped)',
                         constraint[0], constraint[3])
                     cr.execute(
-                        "ALTER TABLE %s DROP CONSTRAINT %s" % (
-                            constraint[3], constraint[0]))
+                        "ALTER TABLE %s DROP CONSTRAINT %s", (
+                            IdentifierAdapter(constraint[3]),
+                            IdentifierAdapter(constraint[0]),
+                        )
+                    )
 
             self.logger.info(
                 'Dropping table %s', line.name)
-            cr.execute("DROP TABLE \"%s\"" % (line.name,))
+            cr.execute("DROP TABLE %s", (IdentifierAdapter(line.name),))
             line.write({'purged': True})
             cr.commit()
         return True
@@ -116,13 +120,11 @@ class CleanupPurgeWizardTable(orm.TransientModel):
                 ]
 
         # Cannot pass table names as a psycopg argument
-        known_tables_repr = ",".join(
-            [("'%s'" % table) for table in known_tables])
         cr.execute(
             """
             SELECT table_name FROM information_schema.tables
             WHERE table_schema = 'public' AND table_type = 'BASE TABLE'
-            AND table_name NOT IN (%s)""" % known_tables_repr)
+            AND table_name NOT IN %s""", (tuple(known_tables),))
 
         res = [(0, 0, {'name': row[0]}) for row in cr.fetchall()]
         if not res: