From 48bbf664227e4be2fee941e08b8ca432aac51b3c Mon Sep 17 00:00:00 2001
From: Mihir Kandoi <kandoimihir@gmail.com>
Date: Fri, 19 Jun 2026 22:11:44 +0530
Subject: [PATCH] refactor(stock): convert packing slip item search to
 qb.get_query

Replace the raw SELECT with get_match_cond in item_details with
frappe.qb.get_query(ignore_permissions=False) plus a Delivery Note Item
subquery; get_query applies the permission match conditions. Same result on
MariaDB; valid under Postgres.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../doctype/packing_slip/packing_slip.py      | 27 +++++++++++++------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/erpnext/stock/doctype/packing_slip/packing_slip.py b/erpnext/stock/doctype/packing_slip/packing_slip.py
index 9544a7a3766..b9423027ffd 100644
--- a/erpnext/stock/doctype/packing_slip/packing_slip.py
+++ b/erpnext/stock/doctype/packing_slip/packing_slip.py
@@ -207,13 +207,24 @@ class PackingSlip(StatusUpdater):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def item_details(doctype: str, txt: str, searchfield: str, start: int, page_len: int, filters: dict):
-	from erpnext.controllers.queries import get_match_cond
+	item = frappe.qb.DocType("Item")
+	dn_item = frappe.qb.DocType("Delivery Note Item")
+	delivery_note = (filters or {}).get("delivery_note")
 
-	return frappe.db.sql(
-		"""select name, item_name, description from `tabItem`
-				where name in ( select item_code FROM `tabDelivery Note Item`
-	 						where parent= {})
-	 			and {} like "{}" {}
-	 			limit  {} offset {} """.format("%s", searchfield, "%s", get_match_cond(doctype), "%s", "%s"),
-		((filters or {}).get("delivery_note"), "%%%s%%" % txt, page_len, start),
+	query = frappe.qb.get_query(
+		"Item",
+		fields=["name", "item_name", "description"],
+		ignore_permissions=False,
+	)
+
+	return (
+		query.where(
+			item.name.isin(
+				frappe.qb.from_(dn_item).select(dn_item.item_code).where(dn_item.parent == delivery_note)
+			)
+			& item[searchfield].like(f"%{txt}%")
+		)
+		.limit(page_len)
+		.offset(start)
+		.run()
 	)