nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-09-02 16:13:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: sql injection (#20818)

Browse Source
This commit is contained in:
Don-Leopardo
2020-03-16 14:06:44 -03:00
committed by GitHub
parent b8b5fa6291
commit 2b6a20aab5
4 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
erpnext/hr/doctype/department/department.py
View File

@@ -48,12 +48,17 @@ def get_abbreviated_name(name, company):
@frappe.whitelist()
def get_children(doctype, parent=None, company=None, is_root=False):
condition = ''
var_dict = {
"name": get_root_of("Department"),
"parent": parent,
"company": company,
}
if company == parent:
condition = "name='{0}'".format(get_root_of("Department"))
condition = "name=%(name)s"
elif company:
condition = "parent_department='{0}' and company='{1}'".format(parent, company)
condition = "parent_department=%(parent)s and company=%(company)s"
else:
condition = "parent_department = '{0}'".format(parent)
condition = "parent_department = %(parent)s"
return frappe.db.sql("""
select
@@ -62,7 +67,7 @@ def get_children(doctype, parent=None, company=None, is_root=False):
from `tab{doctype}`
where
{condition}
order by name""".format(doctype=doctype, condition=condition), as_dict=1)
order by name""".format(doctype=doctype, condition=condition), var_dict, as_dict=1)
@frappe.whitelist()
def add_node():