Merge branch 'develop' of https://github.com/frappe/erpnext into rebrand-ui

erpnext/projects/doctype/project/project.py

@@ -239,6 +239,7 @@ def get_list_context(context=None):
 	}
 
 @frappe.whitelist()
+@frappe.validate_and_sanitize_search_inputs
 def get_users_for_project(doctype, txt, searchfield, start, page_len, filters):
 	conditions = []
 	return frappe.db.sql("""select name, concat_ws(' ', first_name, middle_name, last_name)

erpnext/projects/doctype/task/task.py

@@ -193,6 +193,7 @@ def check_if_child_exists(name):
 
 
 @frappe.whitelist()
+@frappe.validate_and_sanitize_search_inputs
 def get_project(doctype, txt, searchfield, start, page_len, filters):
 	from erpnext.controllers.queries import get_match_cond
 	return frappe.db.sql(""" select name from `tabProject`

erpnext/projects/doctype/timesheet/timesheet.js

@@ -94,13 +94,6 @@ frappe.ui.form.on("Timesheet", {
 		}
 	},
 
-	company: function(frm) {
-		frappe.db.get_value('Company', { 'company_name' : frm.doc.company }, 'standard_working_hours')
-			.then(({ message }) => {
-				(frappe.working_hours = message.standard_working_hours || 0);
-			});
-	},
-
 	make_invoice: function(frm) {
 		let dialog = new frappe.ui.Dialog({
 			title: __("Select Item (optional)"),

erpnext/projects/doctype/timesheet/timesheet.py

@@ -214,6 +214,7 @@ def get_projectwise_timesheet_data(project, parent=None):
 			and sales_invoice is null""".format(cond), {'project': project, 'parent': parent}, as_dict=1)
 
 @frappe.whitelist()
+@frappe.validate_and_sanitize_search_inputs
 def get_timesheet(doctype, txt, searchfield, start, page_len, filters):
 	if not filters: filters = {}
 

erpnext/projects/utils.py

@@ -7,6 +7,7 @@ from __future__ import unicode_literals
 import frappe
 
 @frappe.whitelist()
+@frappe.validate_and_sanitize_search_inputs
 def query_task(doctype, txt, searchfield, start, page_len, filters):
 	from frappe.desk.reportview import build_match_conditions