commit 1b16bca84310a85b217c770f02a0abc30e9f8812
author rohitwaghchaure <rohitw1991@gmail.com> Wed Dec 06 13:16:06 2017 +0530
committer Nabin Hait <nabinhait@gmail.com> Wed Dec 06 13:16:06 2017 +0530
tree 34ef412d4a93de072a40a6a1dff73333aaac256a
parent 6a418f2a9bd57c1923c1db5598ccae6f7468d584

[minor] Escape special characters (#11855)

erpnext/setup/doctype/item_group/item_group.py

diff --git a/erpnext/setup/doctype/item_group/item_group.py b/erpnext/setup/doctype/item_group/item_group.py
index 2766ba0..5dbbd62 100644
--- a/erpnext/setup/doctype/item_group/item_group.py
+++ b/erpnext/setup/doctype/item_group/item_group.py
@@ -81,7 +81,7 @@
 
 @frappe.whitelist(allow_guest=True)
 def get_product_list_for_group(product_group=None, start=0, limit=10, search=None):
-	child_groups = ", ".join(['"' + i[0] + '"' for i in get_child_groups(product_group)])
+	child_groups = ", ".join(['"' + frappe.db.escape(i[0]) + '"' for i in get_child_groups(product_group)])
 
 	# base query
 	query = """select name, item_name, item_code, route, image, website_image, thumbnail, item_group,