refactor: rewrite raw sql queries with frappe.qb and database API

erpnext/accounts/doctype/payment_entry/payment_entry.py

@@ -1175,8 +1175,8 @@ def validate_inclusive_tax(tax, doc):
 
 
 @frappe.whitelist()
+# nosemgrep
 def get_outstanding_reference_documents(args):
-
 	if isinstance(args, str):
 		args = json.loads(args)
 

erpnext/accounts/utils.py

@@ -420,7 +420,7 @@ def add_cc(args=None):
 	return cc.name
 
 
-def reconcile_against_document(args):
+def reconcile_against_document(args):  # nosemgrep
 	"""
 	Cancel PE or JV, Update against document, split if required and resubmit
 	"""

erpnext/hooks.py

@@ -87,6 +87,7 @@ website_context = {
 	"splash_image": "/assets/erpnext/images/erpnext-logo.svg",
 }
 
+# nosemgrep
 website_route_rules = [
 	{"from_route": "/orders", "to_route": "Sales Order"},
 	{

erpnext/setup/doctype/department/department.py

@@ -52,33 +52,18 @@ def get_abbreviated_name(name, company):
 
 @frappe.whitelist()
 def get_children(doctype, parent=None, company=None, is_root=False):
-	condition = ""
+	fields = ["name as value", "is_group as expandable"]
-	var_dict = {
+	filters = {}
-		"name": get_root_of("Department"),
-		"parent": parent,
-		"company": company,
-	}
-	if company == parent:
-		condition = "name=%(name)s"
-	elif company:
-		condition = "parent_department=%(parent)s and company=%(company)s"
-	else:
-		condition = "parent_department = %(parent)s"
 
-	return frappe.db.sql(
+	if company == parent:
-		"""
+		filters["name"] = get_root_of("Department")
-		select
+	elif company:
-			name as value,
+		filters["parent_department"] = parent
-			is_group as expandable
+		filters["company"] = company
-		from `tab{doctype}`
+	else:
-		where
+		filters["parent_department"] = parent
-			{condition}
+
-		order by name""".format(
+	return frappe.get_all(doctype, fields=fields, filters=filters, order_by="name")
-			doctype=doctype, condition=condition
-		),
-		var_dict,
-		as_dict=1,
-	)
 
 
 @frappe.whitelist()

erpnext/setup/doctype/employee/employee.py

@@ -217,14 +217,19 @@ class Employee(NestedSet):
 			frappe.throw(_("User {0} is disabled").format(self.user_id), EmployeeUserDisabledError)
 
 	def validate_duplicate_user_id(self):
-		employee = frappe.db.sql_list(
+		Employee = frappe.qb.DocType("Employee")
-			"""select name from `tabEmployee` where
+		employee = (
-			user_id=%s and status='Active' and name!=%s""",
+			frappe.qb.from_(Employee)
-			(self.user_id, self.name),
+			.select(Employee.name)
+			.where(
+				(Employee.user_id == self.user_id)
+				& (Employee.status == "Active")
+				& (Employee.name != self.name)
 			)
+		).run()
 		if employee:
 			throw(
-				_("User {0} is already assigned to Employee {1}").format(self.user_id, employee[0]),
+				_("User {0} is already assigned to Employee {1}").format(self.user_id, employee[0][0]),
 				frappe.DuplicateEntryError,
 			)
 

erpnext/setup/setup_wizard/operations/defaults_setup.py

@@ -6,6 +6,7 @@ from frappe import _
 from frappe.utils import cstr, getdate
 
 
+# nosemgrep
 def set_default_settings(args):
 	# enable default currency
 	frappe.db.set_value("Currency", args.get("currency"), "enabled", 1)