From 2e707c8a3364897e89c212cecb3e42dd46679799 Mon Sep 17 00:00:00 2001 From: Eben van Deventer Date: Fri, 26 Sep 2025 18:59:51 +0200 Subject: [PATCH] fix(db_query): Issue with certain DocType Names The previous update broke systems where DocTypes exist that contains names like Union or Select (cherry picked from commit f997d40c56d717693c66a8b7e69d12462a673ede) --- frappe/model/db_query.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py index 91e9d32164..0ad7088540 100644 --- a/frappe/model/db_query.py +++ b/frappe/model/db_query.py @@ -1121,13 +1121,18 @@ from {tables} if ORDER_GROUP_PATTERN.match(_lower): frappe.throw(_("Illegal SQL Query")) + # NEW: strip backticked identifiers so words inside table/field names + # (e.g. `tabTrade Union`) don't trigger 'union' / 'select ... from' checks + sanitized = re.sub(r"`[^`]*`", "", _lower) + subquery_indicators = { r"union", r"intersect", r"select\b.*\bfrom", } - if any(re.search(r"\b" + pattern + r"\b", _lower) for pattern in subquery_indicators): + # run the subquery checks against the sanitized string + if any(re.search(r"\b" + pattern + r"\b", sanitized) for pattern in subquery_indicators): frappe.throw(_("Cannot use sub-query here.")) blacklisted_sql_functions = {