Strictly speaking "whom" is correct as it's the object of "have": "You have x there".

But both are okay, "whom" being formal, and "who" being informal.



PaulM