Replace frappe.db.sql to frappe.get_list to apply permissions (#14037)

* Replace frappe.db.sql to frappe.get_list to apply permission
- All get_children method had frappe.db.sql in them which
had no permission check, now its replaced with frappe.get_list
which will check permission based on the user.

* Fix codacy
- Remove trailing whitespace
This commit is contained in:
Suraj Shetty
2018-05-16 10:44:38 +05:30
committed by Rushabh Mehta
parent 11f3e8155b
commit 8501010f12
6 changed files with 75 additions and 72 deletions

View File

@@ -169,11 +169,10 @@ def get_children(doctype, parent, is_root=False):
if is_root:
parent = ''
land_units = frappe.db.sql("""select name as value,
is_group as expandable
from `tabLand Unit`
where ifnull(`parent_land_unit`,'') = %s
order by name""", (parent), as_dict=1)
land_units = frappe.get_list(doctype,
fields = ['name as value', 'is_group as expandable'],
filters= [['parent_land_unit', '=', parent]],
order_by='name')
# return nodes
return land_units