nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-06-08 23:52:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

[fix] injection

Browse Source
This commit is contained in:
Anand Doshi
2015-12-01 17:16:55 +05:30
parent 8320f758be
commit 10e1452450
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
erpnext/accounts/page/accounts_browser/accounts_browser.py
View File

@@ -25,9 +25,9 @@ def get_children():
acc = frappe.db.sql(""" select acc = frappe.db.sql(""" select
name as value, if(group_or_ledger='Group', 1, 0) as expandable %s name as value, if(group_or_ledger='Group', 1, 0) as expandable %s
from `tab%s` from `tab%s`
where ifnull(parent_%s,'') = '' where ifnull(`parent_%s`,'') = ''
and `company` = %s and docstatus<2 and `company` = %s and docstatus<2
order by name""" % (select_cond, ctype, ctype.lower().replace(' ','_'), '%s'), order by name""" % (select_cond, frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
company, as_dict=1) company, as_dict=1)
if args["parent"]=="Accounts": if args["parent"]=="Accounts":
@@ -37,9 +37,9 @@ def get_children():
acc = frappe.db.sql("""select acc = frappe.db.sql("""select
name as value, if(group_or_ledger='Group', 1, 0) as expandable name as value, if(group_or_ledger='Group', 1, 0) as expandable
from `tab%s` from `tab%s`
where ifnull(parent_%s,'') = %s where ifnull(`parent_%s`,'') = %s
and docstatus<2 and docstatus<2
order by name""" % (ctype, ctype.lower().replace(' ','_'), '%s'), order by name""" % (frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
args['parent'], as_dict=1) args['parent'], as_dict=1)
if ctype == 'Account': if ctype == 'Account':

4
erpnext/accounts/utils.py
View File

@@ -50,7 +50,7 @@ def get_balance_on(account=None, date=None):
cond = [] cond = []
if date: if date:
cond.append("posting_date <= '%s'" % date) cond.append("posting_date <= '%s'" % frappe.db.escape(date))
else: else:
# get balance of all entries that exist # get balance of all entries that exist
date = nowdate() date = nowdate()
@@ -79,7 +79,7 @@ def get_balance_on(account=None, date=None):
and ac.lft >= %s and ac.rgt <= %s and ac.lft >= %s and ac.rgt <= %s
)""" % (acc.lft, acc.rgt)) )""" % (acc.lft, acc.rgt))
else: else:
cond.append("""gle.account = "%s" """ % (account.replace('"', '\\"'), )) cond.append("""gle.account = "%s" """ % (frappe.db.escape(account), ))
bal = frappe.db.sql(""" bal = frappe.db.sql("""
SELECT sum(ifnull(debit, 0)) - sum(ifnull(credit, 0)) SELECT sum(ifnull(debit, 0)) - sum(ifnull(credit, 0))