nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-04-12 11:25:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(item_dashboard): escaping warehouse, item_code, stock_uom and item_name on get_data (backport #53904) (#53912)

Browse Source 
* fix(item_dashboard): escaping `warehouse`, `item_code`, `stock_uom` and `item_name` on `get_data` (#53904)

(cherry picked from commit fa5238ba12)

# Conflicts:
#	erpnext/stock/dashboard/item_dashboard.py

* chore: resolve conflict

---------

Co-authored-by: diptanilsaha <diptanil@frappe.io>
This commit is contained in:
mergify[bot]
2026-03-30 09:55:57 +00:00
committed by GitHub
parent 098cbcde10
commit db70d2e4df
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
erpnext/stock/dashboard/item_dashboard.py
View File

@@ -1,6 +1,6 @@
import frappe import frappe
from frappe.model.db_query import DatabaseQuery from frappe.model.db_query import DatabaseQuery
from frappe.utils import cint, flt from frappe.utils import cint, escape_html, flt
from erpnext.stock.doctype.stock_reservation_entry.stock_reservation_entry import ( from erpnext.stock.doctype.stock_reservation_entry.stock_reservation_entry import (
get_sre_reserved_qty_for_items_and_warehouses as get_reserved_stock_details, get_sre_reserved_qty_for_items_and_warehouses as get_reserved_stock_details,
@@ -70,8 +70,10 @@ def get_data(
for item in items: for item in items:
item.update( item.update(
{ {
"item_name": frappe.get_cached_value("Item", item.item_code, "item_name"), "item_code": escape_html(item.item_code),
"stock_uom": frappe.get_cached_value("Item", item.item_code, "stock_uom"), "item_name": escape_html(frappe.get_cached_value("Item", item.item_code, "item_name")),
"stock_uom": escape_html(frappe.get_cached_value("Item", item.item_code, "stock_uom")),
"warehouse": escape_html(item.warehouse),
"disable_quick_entry": frappe.get_cached_value("Item", item.item_code, "has_batch_no") "disable_quick_entry": frappe.get_cached_value("Item", item.item_code, "has_batch_no")
or frappe.get_cached_value("Item", item.item_code, "has_serial_no"), or frappe.get_cached_value("Item", item.item_code, "has_serial_no"),
"projected_qty": flt(item.projected_qty, precision), "projected_qty": flt(item.projected_qty, precision),

6
erpnext/stock/dashboard/item_dashboard_list.html
View File

@@ -50,15 +50,15 @@
data-warehouse="{{ d.warehouse }}" data-warehouse="{{ d.warehouse }}"
data-actual_qty="{{ d.actual_qty }}" data-actual_qty="{{ d.actual_qty }}"
data-stock-uom="{{ d.stock_uom }}" data-stock-uom="{{ d.stock_uom }}"
data-item="{{ escape(d.item_code) }}">{{ __("Move") }}</a> data-item="{{ d.item_code }}">{{ __("Move") }}</button>
{% endif %} {% endif %}
<button style="margin-left: 7px;" class="btn btn-default btn-xs btn-add" <button style="margin-left: 7px;" class="btn btn-default btn-xs btn-add"
data-disable_quick_entry="{{ d.disable_quick_entry }}" data-disable_quick_entry="{{ d.disable_quick_entry }}"
data-warehouse="{{ d.warehouse }}" data-warehouse="{{ d.warehouse }}"
data-actual_qty="{{ d.actual_qty }}" data-actual_qty="{{ d.actual_qty }}"
data-stock-uom="{{ d.stock_uom }}" data-stock-uom="{{ d.stock_uom }}"
data-item="{{ escape(d.item_code) }}" data-item="{{ d.item_code }}"
data-rate="{{ d.valuation_rate }}">{{ __("Add") }}</a> data-rate="{{ d.valuation_rate }}">{{ __("Add") }}</button>
</div> </div>
{% endif %} {% endif %}
</div> </div>