[FIX] util.{remove_records,replace_record_references_batch}

Correctly handle changes in company dependent jsonb columns.

The injected Json should be escaped before query explosion.

Also use `cr.mogrify` instead of manual formatting of the jsonpath
argument of the query.

Author: KangOl

src/util/records.py

@@ -9,6 +9,7 @@
 from operator import itemgetter
 
 import lxml
+from psycopg2 import sql
 from psycopg2.extras import Json, execute_values
 
 try:
@@ -414,29 +415,38 @@ def remove_records(cr, model, ids):
             query = 'DELETE FROM "{}" WHERE {} AND "{}" IN %s'.format(ir.table, ir.model_filter(), ir.res_id)
             cr.execute(query, [model, ids])
         elif ir.company_dependent_comodel == model:
-            query = cr.mogrify(
-                format_query(
-                    cr,
-                    """
+            json_path = cr.mogrify(
+                "$.* ? ({})".format(" || ".join(["@ == %s"] * len(ids))),
+                ids,
+            ).decode()
+            query = (
+                cr.mogrify(
+                    format_query(
+                        cr,
+                        """
                     UPDATE {table}
-                    SET {column} = (
-                        SELECT jsonb_object_agg(
-                            key,
-                            CASE
-                                WHEN value::int4 IN %s THEN NULL
-                                ELSE value::int4
-                            END)
-                        FROM jsonb_each_text({column})
-                    )
-                    WHERE {column} IS NOT NULL
-                    AND {column} @? %s
-                    AND {{parallel_filter}}
+                       SET {column} = (
+                            SELECT jsonb_object_agg(
+                                key,
+                                CASE
+                                    WHEN value::int4 IN %s THEN NULL
+                                    ELSE value::int4
+                                END)
+                              FROM jsonb_each_text({column})
+                           )
+                     WHERE {column} IS NOT NULL
+                       AND {column} @? {json_path}
                     """,
-                    table=ir.table,
-                    column=ir.res_id,
-                ),
-                [ids, "$.* ? ({})".format(" || ".join(map("@ == {}".format, ids)))],
-            ).decode()
+                        table=ir.table,
+                        column=ir.res_id,
+                        json_path=sql.Literal(json_path),
+                    ),
+                    [ids],
+                )
+                .decode()
+                .replace("{", "{{")
+                .replace("}", "}}")
+            )
             explode_execute(cr, query, table=ir.table)
     _rm_refs(cr, model, ids)
 
@@ -1469,24 +1479,34 @@ def replace_record_references_batch(cr, id_mapping, model_src, model_dst=None, r
         if ir.company_dependent_comodel:
             if ir.company_dependent_comodel == model_src:
                 assert model_src == model_dst
-                query = cr.mogrify(
-                    format_query(
-                        cr,
-                        """
+                json_path = cr.mogrify(
+                    "$.* ? ({})".format(" || ".join(["@ == %s"] * len(id_mapping))),
+                    list(id_mapping),
+                ).decode()
+
+                query = (
+                    cr.mogrify(
+                        format_query(
+                            cr,
+                            """
                         UPDATE {table}
                            SET {column} = (
                                    SELECT jsonb_object_agg(key, COALESCE((%s::jsonb->>value)::int, value::int))
                                    FROM jsonb_each_text({column})
                                )
                          WHERE {column} IS NOT NULL
-                           AND {column} @? %s
-                           AND {{parallel_filter}}
+                           AND {column} @? {json_path}
                         """,
-                        table=ir.table,
-                        column=ir.res_id,
-                    ),
-                    [Json(id_mapping), "$.* ? ({})".format(" || ".join(map("@ == {}".format, id_mapping)))],
-                ).decode()
+                            table=ir.table,
+                            column=ir.res_id,
+                            json_path=sql.Literal(json_path),
+                        ),
+                        [Json(id_mapping)],
+                    )
+                    .decode()
+                    .replace("{", "{{")
+                    .replace("}", "}}")
+                )
                 explode_execute(cr, query, table=ir.table)
             continue
         res_model_upd = []