nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-29 06:38:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Add likely missing escapes (backport #55574) (#55580)

Browse Source 
* fix: Add likely missing escaps (#55574)

(cherry picked from commit b72cde73ba)

# Conflicts:
#	erpnext/accounts/doctype/budget/budget.py
#	erpnext/controllers/website_list_for_contact.py

* chore: conflicts

---------

Co-authored-by: Ankush Menat <ankush@frappe.io>
This commit is contained in:
mergify[bot]
2026-06-18 11:32:54 +00:00
committed by GitHub
parent f3334eb2d3
commit ce8fce78f1
10 changed files with 44 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
erpnext/setup/doctype/authorization_control/authorization_control.py
View File

@@ -120,7 +120,9 @@ class AuthorizationControl(TransactionBase):
if val == 1:
add_cond += " and system_user = {}".format(frappe.db.escape(session["user"]))
elif val == 2:
add_cond += " and system_role IN %s" % ("('" + "','".join(frappe.get_roles()) + "')")
add_cond += " and system_role IN (%s)" % ", ".join(
frappe.db.escape(r) for r in frappe.get_roles()
)
else:
add_cond += " and ifnull(system_user,'') = '' and ifnull(system_role,'') = ''"
@@ -203,8 +205,8 @@ class AuthorizationControl(TransactionBase):
and docstatus != 2
""".format(
"%s",
"'" + "','".join(frappe.get_roles()) + "'",
"'" + "','".join(final_based_on) + "'",
", ".join(frappe.db.escape(r) for r in frappe.get_roles()),
", ".join(frappe.db.escape(b) for b in final_based_on),
"%s",
),
(doctype_name, company),