[fix] injection

Update payment_period_based_on_invoice_date.py

erpnext/accounts/page/accounts_browser/accounts_browser.py

@@ -11,42 +11,42 @@ from erpnext.accounts.report.financial_statements import sort_root_accounts
 @frappe.whitelist()
 def get_companies():
 	"""get a list of companies based on permission"""
-	return [d.name for d in frappe.get_list("Company", fields=["name"], 
+	return [d.name for d in frappe.get_list("Company", fields=["name"],
 		order_by="name")]
 
 @frappe.whitelist()
 def get_children():
 	args = frappe.local.form_dict
 	ctype, company = args['ctype'], args['comp']
-	
+
 	# root
 	if args['parent'] in ("Accounts", "Cost Centers"):
 		select_cond = ", root_type, report_type" if args["parent"]=="Accounts" else ""
-		acc = frappe.db.sql(""" select 
+		acc = frappe.db.sql(""" select
 			name as value, if(group_or_ledger='Group', 1, 0) as expandable %s
 			from `tab%s`
-			where ifnull(parent_%s,'') = ''
-			and `company` = %s	and docstatus<2 
-			order by name""" % (select_cond, ctype, ctype.lower().replace(' ','_'), '%s'),
+			where ifnull(`parent_%s`,'') = ''
+			and `company` = %s	and docstatus<2
+			order by name""" % (select_cond, frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
 				company, as_dict=1)
-				
+
 		if args["parent"]=="Accounts":
 			sort_root_accounts(acc)
-	else:	
+	else:
 		# other
-		acc = frappe.db.sql("""select 
+		acc = frappe.db.sql("""select
 			name as value, if(group_or_ledger='Group', 1, 0) as expandable
-	 		from `tab%s` 
-			where ifnull(parent_%s,'') = %s
-			and docstatus<2 
-			order by name""" % (ctype, ctype.lower().replace(' ','_'), '%s'),
+	 		from `tab%s`
+			where ifnull(`parent_%s`,'') = %s
+			and docstatus<2
+			order by name""" % (frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
 				args['parent'], as_dict=1)
-				
+
 	if ctype == 'Account':
 		currency = frappe.db.sql("select default_currency from `tabCompany` where name = %s", company)[0][0]
 		for each in acc:
 			bal = get_balance_on(each.get("value"))
 			each["currency"] = currency
 			each["balance"] = flt(bal)
-		
+
 	return acc

erpnext/accounts/report/payment_period_based_on_invoice_date/payment_period_based_on_invoice_date.py

@@ -10,7 +10,7 @@ from erpnext.accounts.report.accounts_receivable.accounts_receivable import get_
 def execute(filters=None):
 	if not filters: filters = {}
 
-	columns = get_columns()
+	columns = get_columns(filters)
 	entries = get_entries(filters)
 	invoice_posting_date_map = get_invoice_posting_date_map(filters)
 	against_date = ""
@@ -37,14 +37,20 @@ def execute(filters=None):
 
 	return columns, data
 
-def get_columns():
-	return [_("Journal Voucher") + ":Link/Journal Voucher:140", _("Account") + ":Link/Account:140",
-		_("Posting Date") + ":Date:100", _("Against Invoice") + ":Link/Purchase Invoice:130",
-		_("Against Invoice Posting Date") + ":Date:130", _("Debit") + ":Currency:120", _("Credit") + ":Currency:120",
-		_("Reference No") + "::100", _("Reference Date") + ":Date:100", _("Remarks") + "::150", _("Age") +":Int:40",
-		"0-30:Currency:100", "30-60:Currency:100", "60-90:Currency:100", _("90-Above") + ":Currency:100"
-	]
+def get_columns(filters):
+    linkType = ""
+    if filters.get("payment_type") == "Incoming":
+        linkType = "Sales Invoice"
+    else:
+        linkType = "Purchase Invoice"
 
+    return [_("Journal Voucher") + ":Link/Journal Voucher:140", _("Account") + ":Link/Account:140",
+        _("Posting Date") + ":Date:100", _("Against Invoice") + ":Link/"+linkType+":130",
+        _("Against Invoice Posting Date") + ":Date:130", _("Debit") + ":Currency:120", _("Credit") + ":Currency:120",
+        _("Reference No") + "::100", _("Reference Date") + ":Date:100", _("Remarks") + "::150", _("Age") + ":Int:40",
+        "0-30:Currency:100", "30-60:Currency:100", "60-90:Currency:100", _("90-Above") + ":Currency:100"
+        ]
+        
 def get_conditions(filters):
 	conditions = ""
 	party_accounts = []

erpnext/accounts/utils.py

@@ -50,7 +50,7 @@ def get_balance_on(account=None, date=None):
 
 	cond = []
 	if date:
-		cond.append("posting_date <= '%s'" % date)
+		cond.append("posting_date <= '%s'" % frappe.db.escape(date))
 	else:
 		# get balance of all entries that exist
 		date = nowdate()
@@ -79,7 +79,7 @@ def get_balance_on(account=None, date=None):
 			and ac.lft >= %s and ac.rgt <= %s
 		)""" % (acc.lft, acc.rgt))
 	else:
-		cond.append("""gle.account = "%s" """ % (account.replace('"', '\\"'), ))
+		cond.append("""gle.account = "%s" """ % (frappe.db.escape(account), ))
 
 	bal = frappe.db.sql("""
 		SELECT sum(ifnull(debit, 0)) - sum(ifnull(credit, 0))
@@ -420,13 +420,12 @@ def get_outstanding_invoices(amount_query, account):
 		payment_amount = -1*payment_amount[0][0] if payment_amount else 0
 
 		if d.invoice_amount > payment_amount:
-
 			all_outstanding_vouchers.append({
 				'voucher_no': d.voucher_no,
 				'voucher_type': d.voucher_type,
 				'posting_date': d.posting_date,
 				'invoice_amount': flt(d.invoice_amount),
-				'outstanding_amount': d.invoice_amount - payment_amount
+				'outstanding_amount': flt(d.invoice_amount - payment_amount, 2)
 				})
 
 	return all_outstanding_vouchers

erpnext/stock/doctype/bin/bin.py

@@ -33,6 +33,8 @@ class Bin(Document):
 				args["posting_date"] = nowdate()
 
 			# update valuation and qty after transaction for post dated entry
+			if args.get("is_cancelled") == "Yes" and via_landed_cost_voucher:
+				return
 			update_entries_after({
 				"item_code": self.item_code,
 				"warehouse": self.warehouse,