[fix] injection

erpnext/accounts/page/accounts_browser/accounts_browser.py

@@ -26,9 +26,9 @@ def get_children():
 		acc = frappe.db.sql(""" select
 			name as value, is_group as expandable %s
 			from `tab%s`
-			where ifnull(parent_%s,'') = ''
+			where ifnull(`parent_%s`,'') = ''
 			and `company` = %s	and docstatus<2
-			order by name""" % (select_cond, ctype, ctype.lower().replace(' ','_'), '%s'),
+			order by name""" % (select_cond, frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
 				company, as_dict=1)
 
 		if args["parent"]=="Accounts":
@@ -38,9 +38,9 @@ def get_children():
 		acc = frappe.db.sql("""select
 			name as value, is_group as expandable
 	 		from `tab%s`
-			where ifnull(parent_%s,'') = %s
+			where ifnull(`parent_%s`,'') = %s
 			and docstatus<2
-			order by name""" % (ctype, ctype.lower().replace(' ','_'), '%s'),
+			order by name""" % (frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
 				args['parent'], as_dict=1)
 
 	if ctype == 'Account':

erpnext/accounts/utils.py

@@ -62,7 +62,7 @@ def get_balance_on(account=None, date=None, party_type=None, party=None):
 
 	cond = []
 	if date:
-		cond.append("posting_date <= '%s'" % date)
+		cond.append("posting_date <= '%s'" % frappe.db.escape(date))
 	else:
 		# get balance of all entries that exist
 		date = nowdate()
@@ -95,12 +95,12 @@ def get_balance_on(account=None, date=None, party_type=None, party=None):
 				and ac.lft >= %s and ac.rgt <= %s
 			)""" % (acc.lft, acc.rgt))
 		else:
-			cond.append("""gle.account = "%s" """ % (account.replace('"', '\\"'), ))
+			cond.append("""gle.account = "%s" """ % (frappe.db.escape(account),))
 
 	if party_type and party:
 		cond.append("""gle.party_type = "%s" and gle.party = "%s" """ %
-			(party_type.replace('"', '\\"'), party.replace('"', '\\"')))
-			
+			(frappe.db.escape(party_type), frappe.db.escape(party)))
+
 	if account or (party_type and party):
 		bal = frappe.db.sql("""
 			SELECT sum(ifnull(debit, 0)) - sum(ifnull(credit, 0))

erpnext/patches/v5_4/stock_entry_additional_costs.py

@@ -10,12 +10,6 @@ def execute():
 	frappe.reload_doctype("Stock Entry Detail")
 	frappe.reload_doctype("Landed Cost Taxes and Charges")
 
-	frappe.db.sql("""update `tabStock Entry Detail` sed, `tabStock Entry` se
-		set sed.valuation_rate=sed.incoming_rate, sed.basic_rate=sed.incoming_rate, sed.basic_amount=sed.amount
-		where sed.parent = se.name
-		and (se.purpose not in ('Manufacture', 'Repack') or ifnull(additional_operating_cost, 0)=0)
-	""")
-
 	stock_entry_db_columns = frappe.db.get_table_columns("Stock Entry")
 	if "additional_operating_cost" in stock_entry_db_columns:
 		operating_cost_fieldname = "additional_operating_cost"
@@ -25,6 +19,13 @@ def execute():
 		return
 		
 
+	frappe.db.sql("""update `tabStock Entry Detail` sed, `tabStock Entry` se
+		set sed.valuation_rate=sed.incoming_rate, sed.basic_rate=sed.incoming_rate, sed.basic_amount=sed.amount
+		where sed.parent = se.name
+		and (se.purpose not in ('Manufacture', 'Repack') or ifnull({0}, 0)=0)
+	""".format(operating_cost_fieldname))
+		
+
 	stock_entries = frappe.db.sql_list("""select name from `tabStock Entry`
 		where purpose in ('Manufacture', 'Repack') and ifnull({0}, 0)!=0
 		and docstatus < 2""".format(operating_cost_fieldname))