From 55eaba90f500d0deac1f1834c35231e1deddf4f6 Mon Sep 17 00:00:00 2001 From: Saurabh Date: Wed, 30 May 2018 15:07:18 +0530 Subject: [PATCH] [fix] Sanitize blacklisted functions --- frappe/model/db_query.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py index d7fbf032e8..7da25ee453 100644 --- a/frappe/model/db_query.py +++ b/frappe/model/db_query.py @@ -203,7 +203,10 @@ class DatabaseQuery(object): if any(keyword in field.lower().split() for keyword in blacklisted_keywords): _raise_exception() - if any("{0}(".format(keyword) in field.lower().split() for keyword in blacklisted_functions): + if any("({0}".format(keyword) in field.lower() for keyword in blacklisted_keywords): + _raise_exception() + + if any("{0}(".format(keyword) in field.lower() for keyword in blacklisted_functions): _raise_exception() def extract_tables(self):