From a5544d0bfb0babf6d29eb1af78203d760b44989a Mon Sep 17 00:00:00 2001 From: Henil Maru Date: Mon, 3 Aug 2026 16:03:38 +0530 Subject: [PATCH] fix(pos): don't double-escape Item Group names in get_item_groups (#57673) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit frappe.db.escape() wraps the value in quotes (e.g. "'Products'"). Callers pass the result into query-builder isin()/frappe.get_all filters, which parameterize values themselves — so the pre-quoted string never matches a real Item Group name, and POS shows no items whenever a POS Profile restricts Item Groups. Return raw names instead, matching develop. --- erpnext/accounts/doctype/pos_profile/pos_profile.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/erpnext/accounts/doctype/pos_profile/pos_profile.py b/erpnext/accounts/doctype/pos_profile/pos_profile.py index 1e1e6126fef..beaee30e628 100644 --- a/erpnext/accounts/doctype/pos_profile/pos_profile.py +++ b/erpnext/accounts/doctype/pos_profile/pos_profile.py @@ -234,15 +234,18 @@ def get_item_groups(pos_profile): for data in pos_profile.get("item_groups"): item_groups.extend( [ - "%s" % frappe.db.escape(d.name) + d.name for d in get_child_nodes("Item Group", data.item_group) if not permitted_item_groups or d.name in permitted_item_groups ] ) if not item_groups and permitted_item_groups: - item_groups = ["%s" % frappe.db.escape(d) for d in permitted_item_groups] + item_groups = list(permitted_item_groups) + # Return raw Item Group names; the callers parameterize them via the query builder + # (item_group.isin(...)) / frappe.get_all, which escapes them once. Pre-escaping here would + # double-escape (item_group IN ('''X''')) and match nothing. return list(set(item_groups))