nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-29 22:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Add likely missing escaps (#55574)

Browse Source
This commit is contained in:
Ankush Menat
2026-06-03 12:58:05 +05:30
committed by GitHub
parent 260cec3b86
commit b72cde73ba
11 changed files with 56 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
erpnext/controllers/status_updater.py
View File

@@ -524,9 +524,9 @@ class StatusUpdater(Document):
for args in self.status_updater:
# condition to include current record (if submit or no if cancel)
if self.docstatus == 1:
args["cond"] = " or parent='%s'" % self.name.replace('"', '"')
args["cond"] = " or parent=%s" % frappe.db.escape(self.name)
else:
args["cond"] = " and parent!='%s'" % self.name.replace('"', '"')
args["cond"] = " and parent!=%s" % frappe.db.escape(self.name)
self._update_children(args, update_modified)
@@ -556,9 +556,10 @@ class StatusUpdater(Document):
args["second_source_condition"] = frappe.db.sql(
""" select ifnull((select sum({second_source_field})
from `tab{second_source_dt}`
where `{second_join_field}`='{detail_id}'
where `{second_join_field}`=%(detail_id)s
and (`tab{second_source_dt}`.docstatus=1)
{second_source_extra_cond}), 0) """.format(**args)
{second_source_extra_cond}), 0) """.format(**args),
{"detail_id": args["detail_id"]},
)[0][0]
if args["detail_id"]:
@@ -569,9 +570,10 @@ class StatusUpdater(Document):
frappe.db.sql(
"""
(select ifnull(sum({source_field}), 0)
from `tab{source_dt}` where `{join_field}`='{detail_id}'
from `tab{source_dt}` where `{join_field}`=%(detail_id)s
and (docstatus=1 {cond}) {extra_cond})
""".format(**args)
""".format(**args),
{"detail_id": args["detail_id"]},
)[0][0]
or 0.0
)
@@ -582,7 +584,8 @@ class StatusUpdater(Document):
frappe.db.sql(
"""update `tab{target_dt}`
set {target_field} = {source_dt_value} {update_modified}
where name='{detail_id}'""".format(**args)
where name=%(detail_id)s""".format(**args),
{"detail_id": args["detail_id"]},
)
@staticmethod

13
erpnext/controllers/website_list_for_contact.py
View File

@@ -7,7 +7,7 @@ import json
import frappe
from frappe import _
from frappe.modules.utils import get_module_app
from frappe.utils import flt, has_common
from frappe.utils import cint, flt, has_common
from frappe.utils.user import is_website_user
@@ -179,10 +179,13 @@ def get_list_for_transactions(
def rfq_transaction_list(parties_doctype, doctype, parties, limit_start, limit_page_length):
data = frappe.db.sql(
"""select distinct parent as name, supplier from `tab{doctype}`
where supplier = '{supplier}' and docstatus=1 order by creation desc limit {start}, {len}""".format(
doctype=parties_doctype, supplier=parties[0], start=limit_start, len=limit_page_length
),
f"""select distinct parent as name, supplier from `tab{parties_doctype}`
where supplier = %(supplier)s and docstatus=1 order by creation desc limit %(start)s, %(len)s""",
{
"supplier": parties[0],
"start": cint(limit_start),
"len": cint(limit_page_length),
},
as_dict=1,
)