Merge pull request #4331 from nabinhait/pcv_fix
[fix] Allowed Equity accounts in closing account in Period Closing Voucher
diff --git a/erpnext/accounts/doctype/journal_entry/journal_entry.py b/erpnext/accounts/doctype/journal_entry/journal_entry.py
index c5035ad..1a90aab 100644
--- a/erpnext/accounts/doctype/journal_entry/journal_entry.py
+++ b/erpnext/accounts/doctype/journal_entry/journal_entry.py
@@ -2,7 +2,7 @@
# License: GNU General Public License v3. See license.txt
from __future__ import unicode_literals
-import frappe
+import frappe, json
from frappe.utils import cstr, flt, fmt_money, formatdate
from frappe import msgprint, _, scrub
from erpnext.controllers.accounts_controller import AccountsController
@@ -283,7 +283,7 @@
frappe.throw(_("Please check Multi Currency option to allow accounts with other currency"))
self.set_exchange_rate()
-
+
def set_amounts_in_company_currency(self):
for d in self.get("accounts"):
d.debit = flt(flt(d.debit_in_account_currency)*flt(d.exchange_rate), d.precision("debit"))
@@ -520,14 +520,14 @@
"account_currency": account_details.account_currency,
"account_type": account_details.account_type
}
-
+
@frappe.whitelist()
def get_payment_entry_against_order(dt, dn):
ref_doc = frappe.get_doc(dt, dn)
-
+
if flt(ref_doc.per_billed, 2) > 0:
frappe.throw(_("Can only make payment against unbilled {0}").format(dt))
-
+
if dt == "Sales Order":
party_type = "Customer"
amount_field_party = "credit_in_account_currency"
@@ -536,15 +536,15 @@
party_type = "Supplier"
amount_field_party = "debit_in_account_currency"
amount_field_bank = "credit_in_account_currency"
-
+
party_account = get_party_account(party_type, ref_doc.get(party_type.lower()), ref_doc.company)
party_account_currency = get_account_currency(party_account)
-
+
if party_account_currency == ref_doc.company_currency:
amount = flt(ref_doc.base_grand_total) - flt(ref_doc.advance_paid)
else:
amount = flt(ref_doc.grand_total) - flt(ref_doc.advance_paid)
-
+
return get_payment_entry(ref_doc, {
"party_type": party_type,
"party_account": party_account,
@@ -555,7 +555,7 @@
"remarks": 'Advance Payment received against {0} {1}'.format(dt, dn),
"is_advance": "Yes"
})
-
+
@frappe.whitelist()
def get_payment_entry_against_invoice(dt, dn):
ref_doc = frappe.get_doc(dt, dn)
@@ -569,7 +569,7 @@
party_account = ref_doc.credit_to
amount_field_party = "debit_in_account_currency"
amount_field_bank = "credit_in_account_currency"
-
+
return get_payment_entry(ref_doc, {
"party_type": party_type,
"party_account": party_account,
@@ -580,10 +580,10 @@
"remarks": 'Payment received against {0} {1}. {2}'.format(dt, dn, ref_doc.remarks),
"is_advance": "No"
})
-
+
def get_payment_entry(ref_doc, args):
cost_center = frappe.db.get_value("Company", ref_doc.company, "cost_center")
- exchange_rate = get_exchange_rate(args.get("party_account"), args.get("party_account_currency"),
+ exchange_rate = get_exchange_rate(args.get("party_account"), args.get("party_account_currency"),
ref_doc.company, ref_doc.doctype, ref_doc.name)
jv = frappe.new_doc("Journal Entry")
@@ -592,7 +592,7 @@
"company": ref_doc.company,
"remark": args.get("remarks")
})
-
+
party_row = jv.append("accounts", {
"account": args.get("party_account"),
"party_type": args.get("party_type"),
@@ -614,11 +614,11 @@
bank_account = get_default_bank_cash_account(ref_doc.company, "Bank Entry")
if bank_account:
bank_row.update(bank_account)
- bank_row.exchange_rate = get_exchange_rate(bank_account["account"],
+ bank_row.exchange_rate = get_exchange_rate(bank_account["account"],
bank_account["account_currency"], ref_doc.company)
-
+
bank_row.cost_center = cost_center
-
+
if bank_row.account_currency == args.get("party_account_currency"):
bank_row.set(args.get("amount_field_bank"), args.get("amount"))
else:
@@ -630,7 +630,7 @@
jv.multi_currency = 1
jv.set_amounts_in_company_currency()
-
+
return jv.as_dict()
@frappe.whitelist()
@@ -647,14 +647,17 @@
from `tabJournal Entry` jv, `tabJournal Entry Account` jv_detail
where jv_detail.parent = jv.name and jv_detail.account = %s and ifnull(jv_detail.party, '') = %s
and ifnull(jv_detail.reference_type, '') = ''
- and jv.docstatus = 1 and jv.{0} like %s order by jv.name desc limit %s, %s""".format(searchfield),
+ and jv.docstatus = 1 and jv.`{0}` like %s order by jv.name desc limit %s, %s""".format(frappe.db.escape(searchfield)),
(filters.get("account"), cstr(filters.get("party")), "%{0}%".format(txt), start, page_len))
@frappe.whitelist()
def get_outstanding(args):
if not frappe.has_permission("Account"):
frappe.msgprint(_("No Permission"), raise_exception=1)
- args = eval(args)
+
+ if isinstance(args, basestring):
+ args = json.loads(args)
+
company_currency = get_company_currency(args.get("company"))
if args.get("doctype") == "Journal Entry":
diff --git a/erpnext/accounts/doctype/payment_tool/payment_tool.py b/erpnext/accounts/doctype/payment_tool/payment_tool.py
index b4e5f89..aa7b127 100644
--- a/erpnext/accounts/doctype/payment_tool/payment_tool.py
+++ b/erpnext/accounts/doctype/payment_tool/payment_tool.py
@@ -125,6 +125,6 @@
select_cond = "{0} as total_amount".format(ref_field)
details = frappe.db.sql("""select {0} from `tab{1}` where name = %s"""
- .format(select_cond, against_voucher_type), against_voucher_no, as_dict=1)
+ .format(select_cond, frappe.db.escape(against_voucher_type)), against_voucher_no, as_dict=1)
return details[0] if details else {}
diff --git a/erpnext/accounts/doctype/pricing_rule/pricing_rule.py b/erpnext/accounts/doctype/pricing_rule/pricing_rule.py
index 5209e8e..5c65e1f 100644
--- a/erpnext/accounts/doctype/pricing_rule/pricing_rule.py
+++ b/erpnext/accounts/doctype/pricing_rule/pricing_rule.py
@@ -179,7 +179,7 @@
if parent_groups:
if allow_blank: parent_groups.append('')
condition = " ifnull("+field+", '') in ('" + \
- "', '".join([d.replace("'", "\\'").replace('"', '\\"').replace("%", "%%") for d in parent_groups])+"')"
+ "', '".join([frappe.db.escape(d) for d in parent_groups])+"')"
return condition
diff --git a/erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py b/erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py
index 91b01d5..c8f96d3 100644
--- a/erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py
+++ b/erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py
@@ -106,7 +106,7 @@
def check_for_stopped_or_closed_status(self):
check_list = []
pc_obj = frappe.get_doc('Purchase Common')
-
+
for d in self.get('items'):
if d.purchase_order and not d.purchase_order in check_list and not d.purchase_receipt:
check_list.append(d.purchase_order)
@@ -395,7 +395,7 @@
def on_cancel(self):
self.check_for_stopped_or_closed_status()
-
+
if not self.is_return:
from erpnext.accounts.utils import remove_against_link_from_jv
remove_against_link_from_jv(self.doctype, self.name)
@@ -438,10 +438,10 @@
or tabAccount.account_type in ("Expense Account", "Fixed Asset", "Temporary"))
and tabAccount.is_group=0
and tabAccount.docstatus!=2
- and tabAccount.company = '%(company)s'
- and tabAccount.%(key)s LIKE '%(txt)s'
- %(mcond)s""" % {'company': filters['company'], 'key': searchfield,
- 'txt': "%%%s%%" % frappe.db.escape(txt), 'mcond':get_match_cond(doctype)})
+ and tabAccount.company = %(company)s
+ and tabAccount.{key} LIKE %(txt)s
+ {mcond}""".format( key=frappe.db.escape(searchfield), mcond=get_match_cond(doctype) ),
+ { 'company': filters['company'], 'txt': "%%%s%%" % frappe.db.escape(txt) })
@frappe.whitelist()
def make_debit_note(source_name, target_doc=None):
diff --git a/erpnext/accounts/page/accounts_browser/accounts_browser.py b/erpnext/accounts/page/accounts_browser/accounts_browser.py
index 80101ce..210c4bf 100644
--- a/erpnext/accounts/page/accounts_browser/accounts_browser.py
+++ b/erpnext/accounts/page/accounts_browser/accounts_browser.py
@@ -25,9 +25,9 @@
acc = frappe.db.sql(""" select
name as value, is_group as expandable %s
from `tab%s`
- where ifnull(parent_%s,'') = ''
+ where ifnull(`parent_%s`,'') = ''
and `company` = %s and docstatus<2
- order by name""" % (select_cond, ctype, ctype.lower().replace(' ','_'), '%s'),
+ order by name""" % (select_cond, frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
company, as_dict=1)
if args["parent"]=="Accounts":
@@ -38,9 +38,9 @@
acc = frappe.db.sql("""select
name as value, is_group as expandable %s
from `tab%s`
- where ifnull(parent_%s,'') = %s
+ where ifnull(`parent_%s`,'') = %s
and docstatus<2
- order by name""" % (select_cond, ctype, ctype.lower().replace(' ','_'), '%s'),
+ order by name""" % (select_cond, frappe.db.escape(ctype), frappe.db.escape(ctype.lower().replace(' ','_')), '%s'),
args['parent'], as_dict=1)
if ctype == 'Account':
diff --git a/erpnext/accounts/utils.py b/erpnext/accounts/utils.py
index 5d0403e..c2ada13 100644
--- a/erpnext/accounts/utils.py
+++ b/erpnext/accounts/utils.py
@@ -65,7 +65,7 @@
cond = []
if date:
- cond.append("posting_date <= '%s'" % date)
+ cond.append("posting_date <= '%s'" % frappe.db.escape(date))
else:
# get balance of all entries that exist
date = nowdate()
@@ -105,11 +105,11 @@
if acc.account_currency == frappe.db.get_value("Company", acc.company, "default_currency"):
in_account_currency = False
else:
- cond.append("""gle.account = "%s" """ % (account.replace('"', '\\"'), ))
+ cond.append("""gle.account = "%s" """ % (frappe.db.escape(account), ))
if party_type and party:
cond.append("""gle.party_type = "%s" and gle.party = "%s" """ %
- (party_type.replace('"', '\\"'), party.replace('"', '\\"')))
+ (frappe.db.escape(party_type), frappe.db.escape(party)))
if account or (party_type and party):
if in_account_currency:
diff --git a/erpnext/config/docs.py b/erpnext/config/docs.py
index d85dc1d..dc771bc 100644
--- a/erpnext/config/docs.py
+++ b/erpnext/config/docs.py
@@ -2,22 +2,18 @@
docs_base_url = "https://frappe.github.io/erpnext"
headline = "Learn ERPNext Inside Out"
sub_heading = "Find detailed explanation for all ERPNext features"
-long_description = """
-ERPNext helps you to manage all your business information in one application and use it to manage operations and take decisions based on data.
+long_description = """ERPNext is a fully featured ERP system designed for Small and Medium Sized
+business. ERPNext covers a wide range of features including Accounting, CRM,
+Inventory management, Selling, Purchasing, Manufacturing, Projects, HR &
+Payroll, Website, E-Commerce and much more.
-Among other things, ERPNext will help you to:
+ERPNext is based on the Frappe Framework is highly customizable and extendable.
+You can create Custom Form, Fields, Scripts and can also create your own Apps
+to extend ERPNext functionality.
-- Track all Invoices and Payments.
-- Know what quantity of which product is available in stock.
-- Identify open customer queries.
-- Manage payroll.
-- Assign tasks and follow up on them.
-- Maintain a database of all your customers, suppliers and their contacts.
-- Prepare quotes.
-- Get reminders on maintenance schedules.
-- Publish your website.
-
-And a lot lot lot more."""
+ERPNext is Open Source under the GNU General Public Licence v3 and has been
+listed as one of the Best Open Source Softwares in the world by my online
+blogs."""
def get_context(context):
context.top_bar_items = [
diff --git a/erpnext/hooks.py b/erpnext/hooks.py
index bb117c1..8c90b23 100644
--- a/erpnext/hooks.py
+++ b/erpnext/hooks.py
@@ -4,29 +4,7 @@
app_name = "erpnext"
app_title = "ERPNext"
app_publisher = "Frappe Technologies Pvt. Ltd."
-app_description = """## ERPNext
-
-ERPNext is a fully featured ERP system designed for Small and Medium Sized
-business. ERPNext covers a wide range of features including Accounting, CRM,
-Inventory management, Selling, Purchasing, Manufacturing, Projects, HR &
-Payroll, Website, E-Commerce and much more.
-
-ERPNext is based on the Frappe Framework is highly customizable and extendable.
-You can create Custom Form, Fields, Scripts and can also create your own Apps
-to extend ERPNext functionality.
-
-ERPNext is Open Source under the GNU General Public Licence v3 and has been
-listed as one of the Best Open Source Softwares in the world by my online
-blogs.
-
-### Links
-
-- Website: [https://erpnext.com](https://erpnext.com)
-- GitHub: [https://github.com/frappe/erpnext](https://github.com/frappe/erpnext)
-- Forum: [https://discuss.erpnext.com](https://discuss.erpnext.com)
-- Frappe Framework: [https://frappe.io](https://frappe.io)
-
-"""
+app_description = """ERP made simple"""
app_icon = "icon-th"
app_color = "#e74c3c"
app_version = "6.9.2"
diff --git a/erpnext/hr/print_format/offer_letter/offer_letter.json b/erpnext/hr/print_format/offer_letter/offer_letter.json
index d480159..40a3fe1 100644
--- a/erpnext/hr/print_format/offer_letter/offer_letter.json
+++ b/erpnext/hr/print_format/offer_letter/offer_letter.json
@@ -5,8 +5,8 @@
"doc_type": "Offer Letter",
"docstatus": 0,
"doctype": "Print Format",
- "html": "{% if letter_head and not no_letterhead -%}\n <div class=\"letter-head\">{{ letter_head }}</div>\n <hr>\n{%- endif %}\n\n<div class=\"page-break\">\n<p>\n\n<!-- offer letter content starts here, <br> is used to create new lines -->\nDate: {{ doc.offer_date }}\n<br><br>\n\nDear {{ doc.applicant_name }}, \n\n<br><br>\n\nWe are pleased to appoint you in the services of {{ doc.company }} on the terms and conditions detailed in this letter.\n\n<br><br>\n\nYour designation shall be <b>{{ doc.designation }}</b>.\n\n<br><br>\n\n<!-- offer letter terms and description from the table -->\n\n{%- if doc.offer_terms -%}\n {%- for row in doc.offer_terms -%}\n <b>{{ row.offer_term }}:</b> {{ row.value }}\n\n <br>\n {%- endfor -%}\n{%- endif -%}\n\n<br>\n\n<!-- offer letter content continues -->\n\n\nPlease read the detailed terms as below. If you have any queries, feel free to get in touch with us.\nWe look forward to your long and fruitful career association with our organisation.\nIf you decide to join us, 'Welcome to {{ doc.company }} !'\n\n<br><br>\n\n<p class=\"strong\">\n\nYours truly,\n\n<br><br><br><br>\n\nAuthorized Signatory\n\n<br>\n\n{{ doc.company }}\n\n<!-- offer letter content ends here -->\n\n</p>\n</div>\n\n<!-- offer letter terms and conditions -->\n<div> {{ doc.terms }} </div>",
- "modified": "2015-04-01 05:22:51.345050",
+ "html": "{% set terms_exist = (doc.terms|striptags).strip() %}\n\n{% if letter_head and not no_letterhead -%}\n <div class=\"letter-head\">{{ letter_head }}</div>\n <hr>\n{%- endif %}\n\n<div {% if terms_exist -%} class=\"page-break\" {%- endif %}>\n<p>\n\n<!-- offer letter content starts here, <br> is used to create new lines -->\nDate: {{ doc.offer_date }}\n<br><br>\n\nDear {{ doc.applicant_name }}, \n\n<br><br>\n\nWe are pleased to appoint you in the services of {{ doc.company }} on the terms and conditions detailed in this letter.\n\n<br><br>\n\nYour designation shall be <b>{{ doc.designation }}</b>.\n\n<br><br>\n\n<!-- offer letter terms and description from the table -->\n\n{%- if doc.offer_terms -%}\n {%- for row in doc.offer_terms -%}\n <b>{{ row.offer_term }}:</b> {{ row.value }}\n\n <br>\n {%- endfor -%}\n{%- endif -%}\n\n<br>\n\n<!-- offer letter content continues -->\n\n\nPlease read the detailed terms as below. If you have any queries, feel free to get in touch with us.\nWe look forward to your long and fruitful career association with our organisation.\nIf you decide to join us, 'Welcome to {{ doc.company }} !'\n\n<br><br>\n\n<p class=\"strong\">\n\nYours truly,\n\n<br><br><br><br>\n\nAuthorized Signatory\n\n<br>\n\n{{ doc.company }}\n\n<!-- offer letter content ends here -->\n\n</p>\n</div>\n\n<!-- offer letter terms and conditions -->\n{% if terms_exist %}\n<div> {{ doc.terms }} </div>\n{% endif %}",
+ "modified": "2015-11-18 12:53:04.997745",
"modified_by": "Administrator",
"name": "Offer Letter",
"owner": "Administrator",
diff --git a/erpnext/projects/utils.py b/erpnext/projects/utils.py
index fdd0b52..1f6e2b3 100644
--- a/erpnext/projects/utils.py
+++ b/erpnext/projects/utils.py
@@ -13,12 +13,12 @@
@frappe.whitelist()
def query_task(doctype, txt, searchfield, start, page_len, filters):
from frappe.desk.reportview import build_match_conditions
-
+
search_string = "%%%s%%" % txt
order_by_string = "%s%%" % txt
match_conditions = build_match_conditions("Task")
match_conditions = ("and" + match_conditions) if match_conditions else ""
-
+
return frappe.db.sql("""select name, subject from `tabTask`
where (`%s` like %s or `subject` like %s) %s
order by
@@ -26,7 +26,7 @@
case when `%s` like %s then 0 else 1 end,
`%s`,
subject
- limit %s, %s""" %
- (searchfield, "%s", "%s", match_conditions, "%s",
- searchfield, "%s", searchfield, "%s", "%s"),
- (search_string, search_string, order_by_string, order_by_string, start, page_len))
\ No newline at end of file
+ limit %s, %s""" %
+ (frappe.db.escape(searchfield), "%s", "%s", match_conditions, "%s",
+ frappe.db.escape(searchfield), "%s", frappe.db.escape(searchfield), "%s", "%s"),
+ (search_string, search_string, order_by_string, order_by_string, start, page_len))
diff --git a/erpnext/selling/doctype/sales_order/sales_order.py b/erpnext/selling/doctype/sales_order/sales_order.py
index 2f4884b..5ceeea8 100644
--- a/erpnext/selling/doctype/sales_order/sales_order.py
+++ b/erpnext/selling/doctype/sales_order/sales_order.py
@@ -607,7 +607,7 @@
name, supplier_name
limit %(start)s, %(page_len)s """.format(**{
'field': fields,
- 'key': searchfield
+ 'key': frappe.db.escape(searchfield)
}), {
'txt': "%%%s%%" % txt,
'_txt': txt.replace("%", ""),
diff --git a/erpnext/selling/page/sales_browser/sales_browser.py b/erpnext/selling/page/sales_browser/sales_browser.py
index cfb283e..018ba3b 100644
--- a/erpnext/selling/page/sales_browser/sales_browser.py
+++ b/erpnext/selling/page/sales_browser/sales_browser.py
@@ -8,16 +8,16 @@
@frappe.whitelist()
def get_children():
ctype = frappe.local.form_dict.get('ctype')
- frappe.local.form_dict['parent_field'] = 'parent_' + ctype.lower().replace(' ', '_')
- if not frappe.form_dict.get('parent'):
- frappe.local.form_dict['parent'] = ''
+ parent_field = 'parent_' + ctype.lower().replace(' ', '_')
+ parent = frappe.form_dict.get("parent") or ""
return frappe.db.sql("""select name as value,
if(is_group='Yes', 1, 0) as expandable
- from `tab%(ctype)s`
+ from `tab{ctype}`
where docstatus < 2
- and ifnull(%(parent_field)s,'') = "%(parent)s"
- order by name""" % frappe.local.form_dict, as_dict=1)
+ and ifnull(`{parent_field}`,'') = %s
+ order by name""".format(ctype=frappe.db.escape(ctype), parent_field=frappe.db.escape(parent_field)),
+ parent, as_dict=1)
@frappe.whitelist()
def add_node():
diff --git a/erpnext/setup/doctype/email_digest/templates/default.html b/erpnext/setup/doctype/email_digest/templates/default.html
index bd88baf..a931fbb 100644
--- a/erpnext/setup/doctype/email_digest/templates/default.html
+++ b/erpnext/setup/doctype/email_digest/templates/default.html
@@ -117,8 +117,7 @@
<div style="text-align: center; margin: 50px; line-height: 1.5">
{{ quote.text }}<br><i>- {{ quote.author }}</i>
- <br><br><br>
- <span style="color: {{ text_muted }}; font-size: 12px;">Have an intersting thought, quote to share? Email it at hello@erpnext.com</span>
+ <br>
</div>
</div>
diff --git a/erpnext/setup/doctype/sms_settings/sms_settings.py b/erpnext/setup/doctype/sms_settings/sms_settings.py
index 9099863..d0df33a 100644
--- a/erpnext/setup/doctype/sms_settings/sms_settings.py
+++ b/erpnext/setup/doctype/sms_settings/sms_settings.py
@@ -42,7 +42,7 @@
def get_contact_number(contact_name, value, key):
"returns mobile number of the contact"
number = frappe.db.sql("""select mobile_no, phone from tabContact where name=%s and %s=%s""" %
- ('%s', key, '%s'), (contact_name, value))
+ ('%s', frappe.db.escape(key), '%s'), (contact_name, value))
return number and (number[0][0] or number[0][1]) or ''
@frappe.whitelist()
@@ -94,7 +94,7 @@
headers = {}
headers['Accept'] = "text/plain, text/html, */*"
conn.request('GET', api_url + urllib.urlencode(args), headers = headers) # send request
- resp = conn.getresponse() # get response
+ resp = conn.getresponse() # get response
return resp.status
# Split gateway url to server and api url
diff --git a/erpnext/utilities/doctype/address/address.py b/erpnext/utilities/doctype/address/address.py
index 8ae7c4d..a482891 100644
--- a/erpnext/utilities/doctype/address/address.py
+++ b/erpnext/utilities/doctype/address/address.py
@@ -35,7 +35,7 @@
for fieldname in self.link_fields:
if self.get(fieldname):
if not frappe.db.sql("""select name from `tabAddress` where is_primary_address=1
- and `%s`=%s and name!=%s""" % (fieldname, "%s", "%s"),
+ and `%s`=%s and name!=%s""" % (frappe.db.escape(fieldname), "%s", "%s"),
(self.get(fieldname), self.name)):
self.is_primary_address = 1
break