fix get_one sqla.ModelView

[samialfattani]

A run-time error is raised when get_one() is called in flask_admin.contrib.sqla.view.ModelView

To replicate the error try to browse this: /admin/details/?id=1,2

Risk:
A security vulnerability is raised by Tnable where it could lead to Blind SQL Inejection which is classified as a High risk vulnerability. This can be exploited in /edit and /details

A test case is added to make sure that /admin/details/?id=1,2 is working as expected

[ElLorans]

The value is passed to SQLAlchemy’s Session.get() using bound parameters, not interpolated SQL, so the security vulnerability is a false positive.
Passing 1,2 on a model with int primary key returns a 400 response, which is correct, so I am inclined towards closing this PR.

[ElLorans]

Why tools.escape?
Looks unnecessary to me

[samialfattani]

hmmm, what if the actual string-single-PK="1,2", is it possible to navigate /admin/details?id=1,2 without escaping ?

[samialfattani]

The value is passed to SQLAlchemy’s Session.get() using bound parameters, not interpolated SQL, so the security vulnerability is a false positive. Passing 1,2 on a model with int primary key returns a 400 response, which is correct, so I am inclined towards closing this PR.

Actually it returns 500!, here is what we got without this PR