{"action":"created","comment":{"url":"https://api.github.com/repos/OCA/server-tools/pulls/comments/31915463","id":31915463,"diff_hunk":"@@ -0,0 +1,135 @@\n+# -*- coding: utf-8 -*-\n+##############################################################################\n+#\n+#    OpenERP, Open Source Management Solution\n+#    Copyright (C) 2015 Akretion (<http://www.akretion.com>).\n+#\n+#    This program is free software: you can redistribute it and/or modify\n+#    it under the terms of the GNU Affero General Public License as\n+#    published by the Free Software Foundation, either version 3 of the\n+#    License, or (at your option) any later version.\n+#\n+#    This program is distributed in the hope that it will be useful,\n+#    but WITHOUT ANY WARRANTY; without even the implied warranty of\n+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n+#    GNU Affero General Public License for more details.\n+#\n+#    You should have received a copy of the GNU Affero General Public License\n+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.\n+#\n+##############################################################################\n+\n+from openerp.osv.orm import Model\n+from openerp.osv import fields, orm\n+from openerp.tools.translate import _\n+import StringIO\n+import base64\n+import time\n+\n+\n+PROHIBITED_WORDS = [\n+    'delete',\n+    'drop',\n+    'insert',\n+    'alter',\n+    'truncate',\n+    'execute',\n+]\n+\n+\n+class SqlExport(Model):\n+    _name = \"sql.export\"\n+    _description = \"SQL export\"\n+\n+    def _check_query_allowed(self, cr, uid, ids, context=None):\n+        for obj in self.browse(cr, uid, ids, context=context):\n+            if any(word in obj.query.lower() for word in PROHIBITED_WORDS):\n+                return False\n+            if obj.query.strip().split(' ')[0].lower() != 'select':","path":"sql_export/sql.py","position":48,"original_position":48,"commit_id":"e84990f5377840d4f71f413f8c892083a2422f4f","original_commit_id":"e84990f5377840d4f71f413f8c892083a2422f4f","user":{"login":"lmignon","id":544090,"avatar_url":"https://avatars.githubusercontent.com/u/544090?v=3","gravatar_id":"","url":"https://api.github.com/users/lmignon","html_url":"https://github.com/lmignon","followers_url":"https://api.github.com/users/lmignon/followers","following_url":"https://api.github.com/users/lmignon/following{/other_user}","gists_url":"https://api.github.com/users/lmignon/gists{/gist_id}","starred_url":"https://api.github.com/users/lmignon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lmignon/subscriptions","organizations_url":"https://api.github.com/users/lmignon/orgs","repos_url":"https://api.github.com/users/lmignon/repos","events_url":"https://api.github.com/users/lmignon/events{/privacy}","received_events_url":"https://api.github.com/users/lmignon/received_events","type":"User","site_admin":false},"body":"IMO the second `if` is too restrictive.  It's sometimes useful to build query using the `with` clause (http://www.postgresql.org/docs/9.1/static/queries-with.html). Moreover, if you want to test that the query starts with a select you should write\r\n```python\r\n            if not obj.query.lower().startswith('select'):\r\n                return False\r\n```\r\nIMO, checking for prohibited works is enough.","created_at":"2015-06-08T13:49:57Z","updated_at":"2015-06-08T13:49:57Z","html_url":"https://github.com/OCA/server-tools/pull/175#discussion_r31915463","pull_request_url":"https://api.github.com/repos/OCA/server-tools/pulls/175","_links":{"self":{"href":"https://api.github.com/repos/OCA/server-tools/pulls/comments/31915463"},"html":{"href":"https://github.com/OCA/server-tools/pull/175#discussion_r31915463"},"pull_request":{"href":"https://api.github.com/repos/OCA/server-tools/pulls/175"}}},"pull_request":{"url":"https://api.github.com/repos/OCA/server-tools/pulls/175","id":37146283,"html_url":"https://github.com/OCA/server-tools/pull/175","diff_url":"https://github.com/OCA/server-tools/pull/175.diff","patch_url":"https://github.com/OCA/server-tools/pull/175.patch","issue_url":"https://api.github.com/repos/OCA/server-tools/issues/175","number":175,"state":"open","locked":false,"title":"ADD sql_export module","user":{"login":"florian-dacosta","id":5393860,"avatar_url":"https://avatars.githubusercontent.com/u/5393860?v=3","gravatar_id":"","url":"https://api.github.com/users/florian-dacosta","html_url":"https://github.com/florian-dacosta","followers_url":"https://api.github.com/users/florian-dacosta/followers","following_url":"https://api.github.com/users/florian-dacosta/following{/other_user}","gists_url":"https://api.github.com/users/florian-dacosta/gists{/gist_id}","starred_url":"https://api.github.com/users/florian-dacosta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/florian-dacosta/subscriptions","organizations_url":"https://api.github.com/users/florian-dacosta/orgs","repos_url":"https://api.github.com/users/florian-dacosta/repos","events_url":"https://api.github.com/users/florian-dacosta/events{/privacy}","received_events_url":"https://api.github.com/users/florian-dacosta/received_events","type":"User","site_admin":false},"body":"This module is usefull when a user knows how to make sql request. He can extract data from the database easily.\r\nHe also can choose wich user is able to use the sql resquest he creates.","created_at":"2015-06-08T12:02:44Z","updated_at":"2015-06-08T13:49:57Z","closed_at":null,"merged_at":null,"merge_commit_sha":"aec112e9545cd6d07c1ad8d36891487281a3c8af","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/OCA/server-tools/pulls/175/commits","review_comments_url":"https://api.github.com/repos/OCA/server-tools/pulls/175/comments","review_comment_url":"https://api.github.com/repos/OCA/server-tools/pulls/comments{/number}","comments_url":"https://api.github.com/repos/OCA/server-tools/issues/175/comments","statuses_url":"https://api.github.com/repos/OCA/server-tools/statuses/e84990f5377840d4f71f413f8c892083a2422f4f","head":{"label":"florian-dacosta:7.0-sql-export","ref":"7.0-sql-export","sha":"e84990f5377840d4f71f413f8c892083a2422f4f","user":{"login":"florian-dacosta","id":5393860,"avatar_url":"https://avatars.githubusercontent.com/u/5393860?v=3","gravatar_id":"","url":"https://api.github.com/users/florian-dacosta","html_url":"https://github.com/florian-dacosta","followers_url":"https://api.github.com/users/florian-dacosta/followers","following_url":"https://api.github.com/users/florian-dacosta/following{/other_user}","gists_url":"https://api.github.com/users/florian-dacosta/gists{/gist_id}","starred_url":"https://api.github.com/users/florian-dacosta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/florian-dacosta/subscriptions","organizations_url":"https://api.github.com/users/florian-dacosta/orgs","repos_url":"https://api.github.com/users/florian-dacosta/repos","events_url":"https://api.github.com/users/florian-dacosta/events{/privacy}","received_events_url":"https://api.github.com/users/florian-dacosta/received_events","type":"User","site_admin":false},"repo":{"id":37063810,"name":"server-tools","full_name":"florian-dacosta/server-tools","owner":{"login":"florian-dacosta","id":5393860,"avatar_url":"https://avatars.githubusercontent.com/u/5393860?v=3","gravatar_id":"","url":"https://api.github.com/users/florian-dacosta","html_url":"https://github.com/florian-dacosta","followers_url":"https://api.github.com/users/florian-dacosta/followers","following_url":"https://api.github.com/users/florian-dacosta/following{/other_user}","gists_url":"https://api.github.com/users/florian-dacosta/gists{/gist_id}","starred_url":"https://api.github.com/users/florian-dacosta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/florian-dacosta/subscriptions","organizations_url":"https://api.github.com/users/florian-dacosta/orgs","repos_url":"https://api.github.com/users/florian-dacosta/repos","events_url":"https://api.github.com/users/florian-dacosta/events{/privacy}","received_events_url":"https://api.github.com/users/florian-dacosta/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/florian-dacosta/server-tools","description":"Tools for Odoo Administrators to improve some technical features on Odoo.","fork":true,"url":"https://api.github.com/repos/florian-dacosta/server-tools","forks_url":"https://api.github.com/repos/florian-dacosta/server-tools/forks","keys_url":"https://api.github.com/repos/florian-dacosta/server-tools/keys{/key_id}","collaborators_url":"https://api.github.com/repos/florian-dacosta/server-tools/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/florian-dacosta/server-tools/teams","hooks_url":"https://api.github.com/repos/florian-dacosta/server-tools/hooks","issue_events_url":"https://api.github.com/repos/florian-dacosta/server-tools/issues/events{/number}","events_url":"https://api.github.com/repos/florian-dacosta/server-tools/events","assignees_url":"https://api.github.com/repos/florian-dacosta/server-tools/assignees{/user}","branches_url":"https://api.github.com/repos/florian-dacosta/server-tools/branches{/branch}","tags_url":"https://api.github.com/repos/florian-dacosta/server-tools/tags","blobs_url":"https://api.github.com/repos/florian-dacosta/server-tools/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/florian-dacosta/server-tools/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/florian-dacosta/server-tools/git/refs{/sha}","trees_url":"https://api.github.com/repos/florian-dacosta/server-tools/git/trees{/sha}","statuses_url":"https://api.github.com/repos/florian-dacosta/server-tools/statuses/{sha}","languages_url":"https://api.github.com/repos/florian-dacosta/server-tools/languages","stargazers_url":"https://api.github.com/repos/florian-dacosta/server-tools/stargazers","contributors_url":"https://api.github.com/repos/florian-dacosta/server-tools/contributors","subscribers_url":"https://api.github.com/repos/florian-dacosta/server-tools/subscribers","subscription_url":"https://api.github.com/repos/florian-dacosta/server-tools/subscription","commits_url":"https://api.github.com/repos/florian-dacosta/server-tools/commits{/sha}","git_commits_url":"https://api.github.com/repos/florian-dacosta/server-tools/git/commits{/sha}","comments_url":"https://api.github.com/repos/florian-dacosta/server-tools/comments{/number}","issue_comment_url":"https://api.github.com/repos/florian-dacosta/server-tools/issues/comments{/number}","contents_url":"https://api.github.com/repos/florian-dacosta/server-tools/contents/{+path}","compare_url":"https://api.github.com/repos/florian-dacosta/server-tools/compare/{base}...{head}","merges_url":"https://api.github.com/repos/florian-dacosta/server-tools/merges","archive_url":"https://api.github.com/repos/florian-dacosta/server-tools/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/florian-dacosta/server-tools/downloads","issues_url":"https://api.github.com/repos/florian-dacosta/server-tools/issues{/number}","pulls_url":"https://api.github.com/repos/florian-dacosta/server-tools/pulls{/number}","milestones_url":"https://api.github.com/repos/florian-dacosta/server-tools/milestones{/number}","notifications_url":"https://api.github.com/repos/florian-dacosta/server-tools/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/florian-dacosta/server-tools/labels{/name}","releases_url":"https://api.github.com/repos/florian-dacosta/server-tools/releases{/id}","created_at":"2015-06-08T11:50:51Z","updated_at":"2015-06-08T11:50:52Z","pushed_at":"2015-06-08T13:08:15Z","git_url":"git://github.com/florian-dacosta/server-tools.git","ssh_url":"git@github.com:florian-dacosta/server-tools.git","clone_url":"https://github.com/florian-dacosta/server-tools.git","svn_url":"https://github.com/florian-dacosta/server-tools","homepage":"https://community.odoo.com/project/30","size":4941,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"8.0"}},"base":{"label":"OCA:7.0","ref":"7.0","sha":"03c50717ec18b17309fe0244ad4da20add8cfbb6","user":{"login":"OCA","id":7600578,"avatar_url":"https://avatars.githubusercontent.com/u/7600578?v=3","gravatar_id":"","url":"https://api.github.com/users/OCA","html_url":"https://github.com/OCA","followers_url":"https://api.github.com/users/OCA/followers","following_url":"https://api.github.com/users/OCA/following{/other_user}","gists_url":"https://api.github.com/users/OCA/gists{/gist_id}","starred_url":"https://api.github.com/users/OCA/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OCA/subscriptions","organizations_url":"https://api.github.com/users/OCA/orgs","repos_url":"https://api.github.com/users/OCA/repos","events_url":"https://api.github.com/users/OCA/events{/privacy}","received_events_url":"https://api.github.com/users/OCA/received_events","type":"Organization","site_admin":false},"repo":{"id":20896532,"name":"server-tools","full_name":"OCA/server-tools","owner":{"login":"OCA","id":7600578,"avatar_url":"https://avatars.githubusercontent.com/u/7600578?v=3","gravatar_id":"","url":"https://api.github.com/users/OCA","html_url":"https://github.com/OCA","followers_url":"https://api.github.com/users/OCA/followers","following_url":"https://api.github.com/users/OCA/following{/other_user}","gists_url":"https://api.github.com/users/OCA/gists{/gist_id}","starred_url":"https://api.github.com/users/OCA/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OCA/subscriptions","organizations_url":"https://api.github.com/users/OCA/orgs","repos_url":"https://api.github.com/users/OCA/repos","events_url":"https://api.github.com/users/OCA/events{/privacy}","received_events_url":"https://api.github.com/users/OCA/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/OCA/server-tools","description":"Tools for Odoo Administrators to improve some technical features on Odoo.","fork":false,"url":"https://api.github.com/repos/OCA/server-tools","forks_url":"https://api.github.com/repos/OCA/server-tools/forks","keys_url":"https://api.github.com/repos/OCA/server-tools/keys{/key_id}","collaborators_url":"https://api.github.com/repos/OCA/server-tools/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/OCA/server-tools/teams","hooks_url":"https://api.github.com/repos/OCA/server-tools/hooks","issue_events_url":"https://api.github.com/repos/OCA/server-tools/issues/events{/number}","events_url":"https://api.github.com/repos/OCA/server-tools/events","assignees_url":"https://api.github.com/repos/OCA/server-tools/assignees{/user}","branches_url":"https://api.github.com/repos/OCA/server-tools/branches{/branch}","tags_url":"https://api.github.com/repos/OCA/server-tools/tags","blobs_url":"https://api.github.com/repos/OCA/server-tools/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/OCA/server-tools/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/OCA/server-tools/git/refs{/sha}","trees_url":"https://api.github.com/repos/OCA/server-tools/git/trees{/sha}","statuses_url":"https://api.github.com/repos/OCA/server-tools/statuses/{sha}","languages_url":"https://api.github.com/repos/OCA/server-tools/languages","stargazers_url":"https://api.github.com/repos/OCA/server-tools/stargazers","contributors_url":"https://api.github.com/repos/OCA/server-tools/contributors","subscribers_url":"https://api.github.com/repos/OCA/server-tools/subscribers","subscription_url":"https://api.github.com/repos/OCA/server-tools/subscription","commits_url":"https://api.github.com/repos/OCA/server-tools/commits{/sha}","git_commits_url":"https://api.github.com/repos/OCA/server-tools/git/commits{/sha}","comments_url":"https://api.github.com/repos/OCA/server-tools/comments{/number}","issue_comment_url":"https://api.github.com/repos/OCA/server-tools/issues/comments{/number}","contents_url":"https://api.github.com/repos/OCA/server-tools/contents/{+path}","compare_url":"https://api.github.com/repos/OCA/server-tools/compare/{base}...{head}","merges_url":"https://api.github.com/repos/OCA/server-tools/merges","archive_url":"https://api.github.com/repos/OCA/server-tools/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/OCA/server-tools/downloads","issues_url":"https://api.github.com/repos/OCA/server-tools/issues{/number}","pulls_url":"https://api.github.com/repos/OCA/server-tools/pulls{/number}","milestones_url":"https://api.github.com/repos/OCA/server-tools/milestones{/number}","notifications_url":"https://api.github.com/repos/OCA/server-tools/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/OCA/server-tools/labels{/name}","releases_url":"https://api.github.com/repos/OCA/server-tools/releases{/id}","created_at":"2014-06-16T18:52:44Z","updated_at":"2015-06-04T06:17:24Z","pushed_at":"2015-06-08T13:08:16Z","git_url":"git://github.com/OCA/server-tools.git","ssh_url":"git@github.com:OCA/server-tools.git","clone_url":"https://github.com/OCA/server-tools.git","svn_url":"https://github.com/OCA/server-tools","homepage":"https://community.odoo.com/project/30","size":4941,"stargazers_count":52,"watchers_count":52,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":129,"mirror_url":null,"open_issues_count":44,"forks":129,"open_issues":44,"watchers":52,"default_branch":"8.0"}},"_links":{"self":{"href":"https://api.github.com/repos/OCA/server-tools/pulls/175"},"html":{"href":"https://github.com/OCA/server-tools/pull/175"},"issue":{"href":"https://api.github.com/repos/OCA/server-tools/issues/175"},"comments":{"href":"https://api.github.com/repos/OCA/server-tools/issues/175/comments"},"review_comments":{"href":"https://api.github.com/repos/OCA/server-tools/pulls/175/comments"},"review_comment":{"href":"https://api.github.com/repos/OCA/server-tools/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/OCA/server-tools/pulls/175/commits"},"statuses":{"href":"https://api.github.com/repos/OCA/server-tools/statuses/e84990f5377840d4f71f413f8c892083a2422f4f"}}}}