fix: escaped warehouse value for sql query (bp #26049)
Co-authored-by: Noah Jacob <noahjacobkurian@gmail.com>
diff --git a/erpnext/controllers/stock_controller.py b/erpnext/controllers/stock_controller.py
index 9c29b00..6a7c9e3 100644
--- a/erpnext/controllers/stock_controller.py
+++ b/erpnext/controllers/stock_controller.py
@@ -558,11 +558,8 @@
or_conditions = []
for warehouse, items in warehouse_items_map.items():
or_conditions.append(
- "warehouse = '{}' and item_code in ({})".format(
- warehouse,
- ", ".join(frappe.db.escape(item) for item in items)
- )
- )
+ f"""warehouse = {frappe.db.escape(warehouse)}
+ and item_code in ({', '.join(frappe.db.escape(item) for item in items)})""")
return frappe.db.sql("""
select name