nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-24 12:36:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

[fix] injection

Browse Source
This commit is contained in:
Anand Doshi
2015-11-17 18:27:50 +05:30
parent 3667da1053
commit da79740cdf
11 changed files with 53 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/utilities/doctype/address/address.py
View File

@@ -35,7 +35,7 @@ class Address(Document):
for fieldname in self.link_fields:
if self.get(fieldname):
if not frappe.db.sql("""select name from `tabAddress` where is_primary_address=1
and `%s`=%s and name!=%s""" % (fieldname, "%s", "%s"),
and `%s`=%s and name!=%s""" % (frappe.db.escape(fieldname), "%s", "%s"),
(self.get(fieldname), self.name)):
self.is_primary_address = 1
break