schuetz3/schuetz3-erpnext
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sqli): Avoid SQL Injection with sender param (#16509)

Browse Source
This commit is contained in:
Aditya Hase
2019-01-29 10:52:37 +05:30
committed by Sagar Vora
parent 385e3bb284
commit 9acb885e60
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/templates/utils.py
View File

@@ -16,7 +16,7 @@ def send_message(subject="Website Query", message="", sender="", status="Open"):
customer = frappe.db.sql("""select distinct dl.link_name from `tabDynamic Link` dl customer = frappe.db.sql("""select distinct dl.link_name from `tabDynamic Link` dl
left join `tabContact` c on dl.parent=c.name where dl.link_doctype='Customer' left join `tabContact` c on dl.parent=c.name where dl.link_doctype='Customer'
and c.email_id='{email_id}'""".format(email_id=sender)) and c.email_id = %s""", sender)
if not customer: if not customer:
lead = frappe.db.get_value('Lead', dict(email_id=sender)) lead = frappe.db.get_value('Lead', dict(email_id=sender))