oops on $team/+reassign page when entering "%"

[Edwin Grubbs]

This is not a security vulnerability since arbitrary sql can't be injected. The '%' is just not escaped, so psycopg's variable substitution blows up.

The ValidPersonOrTeamVocabulary uses SQL() to add hand-coded sql to a storm query. When it does this, it uses python string substitutions. Instead, we should use the optional second argument to SQL() to pass in the variables, which will escape them properly.
For example:
   SQL('SELECT name FROM person WHERE id = ? AND displayname = ?', (33, 'foo'))

This should also eliminate the need to use quote() and quote_like() on the parameters.

OOPS-1321S1050

[Curtis Hovey (sinzui)]

Fixed in launchpad devel r9933.

[Curtis Hovey (sinzui)]

Fixed released in launchpad-project 3.1.11.