nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-13 22:51:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(stock): permission check and test cleanup for bundle item fetch

Browse Source 
The whitelisted get_items_from_product_bundle endpoint now verifies read
permission on Product Bundle (doc-level when a name is passed, doctype-
level for the legacy item_code path) so authenticated users can't
enumerate bundle components. The disabled-bundle test also restores the
disabled flag via addCleanup.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mihir Kandoi
2026-06-10 21:42:30 +05:30
parent bfee9df9aa
commit 0c6f7fed55
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
erpnext/stock/doctype/packed_item/packed_item.py
View File

@@ -465,6 +465,7 @@ def get_items_from_product_bundle(row: str):
parent item's active version.
"""
row, items = ItemDetailsCtx(json.loads(row)), []
frappe.has_permission("Product Bundle", "read", row.get("product_bundle"), throw=True)
if bundle_name := row.get("product_bundle"):
bundle = frappe.db.get_value("Product Bundle", bundle_name, ["docstatus", "disabled"], as_dict=True)

1
erpnext/stock/doctype/packed_item/test_packed_item.py
View File

@@ -232,6 +232,7 @@ class TestPackedItem(ERPNextTestSuite):
# a disabled version is rejected
frappe.db.set_value("Product Bundle", version, "disabled", 1)
self.addCleanup(frappe.db.set_value, "Product Bundle", version, "disabled", 0)
self.assertRaises(
frappe.ValidationError,
get_items_from_product_bundle,