Shiloh/brotherton-erpnext
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[fix] Escape values in queries

Browse Source
This commit is contained in:
Nabin Hait 2015-06-27 12:51:00 +05:30
parent dfac6848cc
commit 93cdee4503
7 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py
View File

@ -410,4 +410,4 @@ def get_expense_account(doctype, txt, searchfield, start, page_len, filters):
and tabAccount.company = '%(company)s'
and tabAccount.%(key)s LIKE '%(txt)s'
%(mcond)s""" % {'company': filters['company'], 'key': searchfield,
'txt': "%%%s%%" % txt, 'mcond':get_match_cond(doctype)})
'txt': "%%%s%%" % frappe.db.escape(txt), 'mcond':get_match_cond(doctype)})

2
erpnext/accounts/doctype/sales_invoice/pos.py
View File

@ -36,7 +36,7 @@ def get_items(price_list, sales_or_purchase, item=None):
if(locate(%(_name)s, i.item_name), locate(%(_name)s, i.item_name), 99999),
if(locate(%(_name)s, i.variant_of), locate(%(_name)s, i.variant_of), 99999),
if(locate(%(_name)s, i.item_group), locate(%(_name)s, i.item_group), 99999),"""
args["name"] = "%%%s%%" % item
args["name"] = "%%%s%%" % frappe.db.escape(item)
args["_name"] = item.replace("%", "")
# locate function is used to sort by closest match from the beginning of the value

2
erpnext/accounts/doctype/sales_invoice/sales_invoice.py
View File

@ -611,7 +611,7 @@ def get_income_account(doctype, txt, searchfield, start, page_len, filters):
and tabAccount.company = '%(company)s'
and tabAccount.%(key)s LIKE '%(txt)s'
%(mcond)s""" % {'company': filters['company'], 'key': searchfield,
'txt': "%%%s%%" % txt, 'mcond':get_match_cond(doctype)})
'txt': "%%%s%%" % frappe.db.escape(txt), 'mcond':get_match_cond(doctype)})
@frappe.whitelist()
def make_delivery_note(source_name, target_doc=None):

4
erpnext/controllers/queries.py
View File

@ -194,7 +194,7 @@ def bom(doctype, txt, searchfield, start, page_len, filters):
and tabBOM.is_active=1
and tabBOM.%(key)s like "%(txt)s"
%(fcond)s %(mcond)s
limit %(start)s, %(page_len)s """ % {'key': searchfield, 'txt': "%%%s%%" % txt,
limit %(start)s, %(page_len)s """ % {'key': searchfield, 'txt': "%%%s%%" % frappe.db.escape(txt),
'fcond': get_filters_cond(doctype, filters, conditions),
'mcond':get_match_cond(doctype), 'start': start, 'page_len': page_len})
@ -207,7 +207,7 @@ def get_project_name(doctype, txt, searchfield, start, page_len, filters):
where `tabProject`.status not in ("Completed", "Cancelled")
and %(cond)s `tabProject`.name like "%(txt)s" %(mcond)s
order by `tabProject`.name asc
limit %(start)s, %(page_len)s """ % {'cond': cond,'txt': "%%%s%%" % txt,
limit %(start)s, %(page_len)s """ % {'cond': cond,'txt': "%%%s%%" % frappe.db.escape(txt),
'mcond':get_match_cond(doctype),'start': start, 'page_len': page_len})
def get_delivery_notes_to_be_billed(doctype, txt, searchfield, start, page_len, filters):

2
erpnext/projects/doctype/task/task.py
View File

@ -141,7 +141,7 @@ def get_project(doctype, txt, searchfield, start, page_len, filters):
%(mcond)s
order by name
limit %(start)s, %(page_len)s """ % {'key': searchfield,
'txt': "%%%s%%" % txt, 'mcond':get_match_cond(doctype),
'txt': "%%%s%%" % frappe.db.escape(txt), 'mcond':get_match_cond(doctype),
'start': start, 'page_len': page_len})

4
erpnext/stock/doctype/item/item.json
View File

@ -707,7 +707,7 @@
"fieldtype": "Link",
"ignore_user_permissions": 1,
"label": "Default BOM",
"no_copy": 0,
"no_copy": 1,
"oldfieldname": "default_bom",
"oldfieldtype": "Link",
"options": "BOM",
@ -879,7 +879,7 @@
"icon": "icon-tag",
"idx": 1,
"max_attachments": 1,
"modified": "2015-05-22 02:16:57.435105",
"modified": "2015-06-26 17:20:18.204558",
"modified_by": "Administrator",
"module": "Stock",
"name": "Item",

2
erpnext/stock/doctype/serial_no/serial_no.py
View File

@ -180,7 +180,7 @@ class SerialNo(StockController):
where fieldname='serial_no' and fieldtype='Text'"""):
for item in frappe.db.sql("""select name, serial_no from `tab%s`
where serial_no like '%%%s%%'""" % (dt[0], old)):
where serial_no like '%%%s%%'""" % (dt[0], frappe.db.escape(old))):
serial_nos = map(lambda i: i==old and new or i, item[1].split('\n'))
frappe.db.sql("""update `tab%s` set serial_no = %s