From 73dff8993a560447369fe93e7ec73266e649d127 Mon Sep 17 00:00:00 2001 From: 0Pranav Date: Thu, 16 Jan 2020 17:36:17 +0530 Subject: [PATCH] fix: imporer escaping --- .../doctype/authorization_control/authorization_control.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/erpnext/setup/doctype/authorization_control/authorization_control.py b/erpnext/setup/doctype/authorization_control/authorization_control.py index 6a184b1a166..55e1ed0d3a7 100644 --- a/erpnext/setup/doctype/authorization_control/authorization_control.py +++ b/erpnext/setup/doctype/authorization_control/authorization_control.py @@ -76,7 +76,7 @@ class AuthorizationControl(TransactionBase): add_cond = '' auth_value = av_dis - if val == 1: add_cond += " and system_user = '"+ frappe.db.escape(session['user']) +"'" + if val == 1: add_cond += " and system_user = {0}".format(frappe.db.escape(session['user'])) elif val == 2: add_cond += " and system_role IN %s" % ("('"+"','".join(frappe.get_roles())+"')") else: add_cond += " and ifnull(system_user,'') = '' and ifnull(system_role,'') = ''" @@ -85,7 +85,7 @@ class AuthorizationControl(TransactionBase): if doc_obj: if doc_obj.doctype == 'Sales Invoice': customer = doc_obj.customer else: customer = doc_obj.customer_name - add_cond = " and master_name = '"+ frappe.db.escape(customer) +"'" + add_cond = " and master_name = {0}".format(frappe.db.escape(customer)) if based_on == 'Itemwise Discount': if doc_obj: for t in doc_obj.get("items"):