1923ef052c
* refactor: Sanitize whitelisted method inputs Co-authored-by: Prssanna Desai <prssud@gmail.com> Co-authored-by: Shivam Mishra <scmmishra@users.noreply.github.com> * refactor: Format and sanitize tax_account_query inputs Co-authored-by: Nabin Hait <nabinhait@gmail.com> Co-authored-by: Prssanna Desai <prssud@gmail.com> Co-authored-by: Shivam Mishra <scmmishra@users.noreply.github.com> * refactor: Validate and sanitize search inputs via decorator Co-authored-by: Nabin Hait <nabinhait@gmail.com> Co-authored-by: Prssanna Desai <prssud@gmail.com> Co-authored-by: Shivam Mishra <scmmishra@users.noreply.github.com> * style: Minor formatting fix * refactor: Validate and sanitize search inputs using decorator * fix: Typo * fix: Remove unwanted import statement * refactor: Repalce validate_and_sanitize_search_inputs() with validate_and_sanitize_search_inputs Co-authored-by: Prssanna Desai <prssud@gmail.com> Co-authored-by: Shivam Mishra <scmmishra@users.noreply.github.com> Co-authored-by: Prssanna Desai <prssud@gmail.com> Co-authored-by: Shivam Mishra <scmmishra@users.noreply.github.com> Co-authored-by: Nabin Hait <nabinhait@gmail.com>
30 lines
1.0 KiB
Python
30 lines
1.0 KiB
Python
# Copyright (c) 2015, Frappe Technologies Pvt. Ltd. and Contributors
|
|
# License: GNU General Public License v3. See license.txt
|
|
|
|
# For license information, please see license.txt
|
|
|
|
from __future__ import unicode_literals
|
|
import frappe
|
|
|
|
@frappe.whitelist()
|
|
@frappe.validate_and_sanitize_search_inputs
|
|
def query_task(doctype, txt, searchfield, start, page_len, filters):
|
|
from frappe.desk.reportview import build_match_conditions
|
|
|
|
search_string = "%%%s%%" % txt
|
|
order_by_string = "%s%%" % txt
|
|
match_conditions = build_match_conditions("Task")
|
|
match_conditions = ("and" + match_conditions) if match_conditions else ""
|
|
|
|
return frappe.db.sql("""select name, subject from `tabTask`
|
|
where (`%s` like %s or `subject` like %s) %s
|
|
order by
|
|
case when `subject` like %s then 0 else 1 end,
|
|
case when `%s` like %s then 0 else 1 end,
|
|
`%s`,
|
|
subject
|
|
limit %s, %s""" %
|
|
(searchfield, "%s", "%s", match_conditions, "%s",
|
|
searchfield, "%s", searchfield, "%s", "%s"),
|
|
(search_string, search_string, order_by_string, order_by_string, start, page_len))
|