From 0c6f7fed55a46930170145566b6c4b00a7314288 Mon Sep 17 00:00:00 2001 From: Mihir Kandoi Date: Wed, 10 Jun 2026 21:42:30 +0530 Subject: [PATCH] fix(stock): permission check and test cleanup for bundle item fetch The whitelisted get_items_from_product_bundle endpoint now verifies read permission on Product Bundle (doc-level when a name is passed, doctype- level for the legacy item_code path) so authenticated users can't enumerate bundle components. The disabled-bundle test also restores the disabled flag via addCleanup. Co-Authored-By: Claude Fable 5 --- erpnext/stock/doctype/packed_item/packed_item.py | 1 + erpnext/stock/doctype/packed_item/test_packed_item.py | 1 + 2 files changed, 2 insertions(+) diff --git a/erpnext/stock/doctype/packed_item/packed_item.py b/erpnext/stock/doctype/packed_item/packed_item.py index 1eaa8163bbe..8045bbdaadb 100644 --- a/erpnext/stock/doctype/packed_item/packed_item.py +++ b/erpnext/stock/doctype/packed_item/packed_item.py @@ -465,6 +465,7 @@ def get_items_from_product_bundle(row: str): parent item's active version. """ row, items = ItemDetailsCtx(json.loads(row)), [] + frappe.has_permission("Product Bundle", "read", row.get("product_bundle"), throw=True) if bundle_name := row.get("product_bundle"): bundle = frappe.db.get_value("Product Bundle", bundle_name, ["docstatus", "disabled"], as_dict=True) diff --git a/erpnext/stock/doctype/packed_item/test_packed_item.py b/erpnext/stock/doctype/packed_item/test_packed_item.py index 812596dd1e6..5a91978e9d9 100644 --- a/erpnext/stock/doctype/packed_item/test_packed_item.py +++ b/erpnext/stock/doctype/packed_item/test_packed_item.py @@ -232,6 +232,7 @@ class TestPackedItem(ERPNextTestSuite): # a disabled version is rejected frappe.db.set_value("Product Bundle", version, "disabled", 1) + self.addCleanup(frappe.db.set_value, "Product Bundle", version, "disabled", 0) self.assertRaises( frappe.ValidationError, get_items_from_product_bundle,