Fix sql injection
diff --git a/erpnext/setup/doctype/item_group/item_group.py b/erpnext/setup/doctype/item_group/item_group.py
index 22375ae..9f25882 100644
--- a/erpnext/setup/doctype/item_group/item_group.py
+++ b/erpnext/setup/doctype/item_group/item_group.py
@@ -119,7 +119,7 @@
or I.name like %(search)s)"""
search = "%" + cstr(search) + "%"
- query += """order by I.weightage desc, in_stock desc, I.modified desc limit %s, %s""" % (start, limit)
+ query += """order by I.weightage desc, in_stock desc, I.modified desc limit %s, %s""" % (cint(start), cint(limit))
data = frappe.db.sql(query, {"product_group": product_group,"search": search, "today": nowdate()}, as_dict=1)
data = adjust_qty_for_expired_items(data)