vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

[fix] consider optional fields too while chekcing sql injection

Browse source
This commit is contained in:
Saurabh 2017-03-02 16:51:20 +05:30
parent 5f5d3066fa
commit b2b2df56aa
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
frappe/model/db_query.py
View file

@ -493,7 +493,7 @@ class DatabaseQuery(object):
frappe.throw(_("Please select atleast 1 column from {0} to sort/group").format(tbl))
else:
field = field.strip().split(' ')[0]
if field not in [f.fieldname for f in meta.fields] and field not in default_fields:
if field not in [f.fieldname for f in meta.fields] and field not in (default_fields + optional_fields):
frappe.throw(_("Invalid field used to sort/group: {0}").format(field))
def add_limit(self):