Language: Python
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    def get_all_progress(self, recency=_progress_period_secs * 2):
        """
        Get progress information for all ongoing operations
        :param recency: (int) seconds back
        :return list of progress codes
        """
        query = """
        SELECT code, array_agg(state) FROM web_progress
        WHERE create_date > timezone('utc', now()) - INTERVAL '{recency} SECOND'
              AND recur_depth = 0 {user_id}
        GROUP BY code
        """.format(
            recency=recency or 0,
            user_id=not self.is_progress_admin() and "AND create_uid = {user_id}"
                .format(
                user_id=self.env.user.id,
            ) or '')
        # superuser has right to see (and cancel) progress of everybody
        self.env.cr.execute(query)
        result = self.env.cr.fetchall()
        ret = [{
            'code': r[0],
        } for r in result if r[0] and 'cancel' not in r[1] and 'done' not in r[1]]
        return ret