schuetz3/schuetz3-erpnext
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Treeview permission (#14232)

Browse Source 
* Replace frappe.db.sql to frappe.get_list to apply permissions (#14037)

* Replace frappe.db.sql to frappe.get_list to apply permission
- All get_children method had frappe.db.sql in them which
had no permission check, now its replaced with frappe.get_list
which will check permission based on the user.

* Fix codacy
- Remove trailing whitespace

* Add parent filter

* Add ifnull checks
This commit is contained in:
Suraj Shetty
2018-05-26 09:12:59 +05:30
committed by Nabin Hait
parent aadfaa4493
commit 084b0b3a67
6 changed files with 94 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
erpnext/accounts/utils.py
View File

@@ -497,7 +497,7 @@ def get_company_default(company, fieldname):
if not value:
throw(_("Please set default {0} in Company {1}")
.format(frappe.get_meta("Company").get_label(fieldname), company))
.format(frappe.get_meta("Company").get_label(fieldname), company))
return value
@@ -550,16 +550,16 @@ def get_stock_rbnb_difference(posting_date, company):
pr_valuation_amount = frappe.db.sql("""
select sum(pr_item.valuation_rate * pr_item.qty * pr_item.conversion_factor)
from `tabPurchase Receipt Item` pr_item, `tabPurchase Receipt` pr
where pr.name = pr_item.parent and pr.docstatus=1 and pr.company=%s
where pr.name = pr_item.parent and pr.docstatus=1 and pr.company=%s
and pr.posting_date <= %s and pr_item.item_code in (%s)""" %
('%s', '%s', ', '.join(['%s']*len(stock_items))), tuple([company, posting_date] + stock_items))[0][0]
('%s', '%s', ', '.join(['%s']*len(stock_items))), tuple([company, posting_date] + stock_items))[0][0]
pi_valuation_amount = frappe.db.sql("""
select sum(pi_item.valuation_rate * pi_item.qty * pi_item.conversion_factor)
from `tabPurchase Invoice Item` pi_item, `tabPurchase Invoice` pi
where pi.name = pi_item.parent and pi.docstatus=1 and pi.company=%s
where pi.name = pi_item.parent and pi.docstatus=1 and pi.company=%s
and pi.posting_date <= %s and pi_item.item_code in (%s)""" %
('%s', '%s', ', '.join(['%s']*len(stock_items))), tuple([company, posting_date] + stock_items))[0][0]
('%s', '%s', ', '.join(['%s']*len(stock_items))), tuple([company, posting_date] + stock_items))[0][0]
# Balance should be
stock_rbnb = flt(pr_valuation_amount, 2) - flt(pi_valuation_amount, 2)
@@ -681,29 +681,24 @@ def get_companies():
def get_children(doctype, parent, company, is_root=False):
from erpnext.accounts.report.financial_statements import sort_accounts
fieldname = frappe.db.escape(doctype.lower().replace(' ','_'))
doctype = frappe.db.escape(doctype)
parent_fieldname = 'parent_' + doctype.lower().replace(' ', '_')
fields = [
'name as value',
'is_group as expandable'
]
filters = [['docstatus', '<', 2]]
filters.append(['ifnull(`{0}`,"")'.format(parent_fieldname), '=', '' if is_root else parent])
# root
if is_root:
fields = ", root_type, report_type, account_currency" if doctype=="Account" else ""
acc = frappe.db.sql(""" select
name as value, is_group as expandable {fields}
from `tab{doctype}`
where ifnull(`parent_{fieldname}`,'') = ''
and `company` = %s and docstatus<2
order by name""".format(fields=fields, fieldname = fieldname, doctype=doctype),
company, as_dict=1)
fields += ['root_type', 'report_type', 'account_currency'] if doctype == 'Account' else []
filters.append(['company', '=', company])
else:
# other
fields = ", account_currency" if doctype=="Account" else ""
acc = frappe.db.sql("""select
name as value, is_group as expandable, parent_{fieldname} as parent {fields}
from `tab{doctype}`
where ifnull(`parent_{fieldname}`,'') = %s
and docstatus<2
order by name""".format(fields=fields, fieldname=fieldname, doctype=doctype),
parent, as_dict=1)
fields += ['account_currency'] if doctype == 'Account' else []
fields += [parent_fieldname + ' as parent']
acc = frappe.get_list(doctype, fields=fields, filters=filters)
if doctype == 'Account':
sort_accounts(acc, is_root, key="value")