From af8c010aa877c034a4818dccd1dcaef197e43100 Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Fri, 21 Aug 2026 13:17:47 +0530 Subject: [PATCH 1/2] fix(projects): check read permission on source in create_duplicate_project (cherry picked from commit 8c8b282a2ef5f10a22acc5e009863b313f2450bf) --- erpnext/projects/doctype/project/project.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py index 80ef45c099d..b0cda8df8f8 100644 --- a/erpnext/projects/doctype/project/project.py +++ b/erpnext/projects/doctype/project/project.py @@ -596,6 +596,10 @@ def create_duplicate_project(prev_doc, project_name): prev_doc = json.loads(prev_doc) + # prev_doc is caller-supplied, but the tasks below are read from the db by name + if source_name := prev_doc.get("name"): + frappe.has_permission("Project", "read", source_name, throw=True) + if project_name == prev_doc.get("name"): frappe.throw(_("Use a name that is different from previous project name")) From 0ea03a688bad47b82a5002d75a5918d24d2ed5b3 Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Mon, 31 Aug 2026 14:04:32 +0530 Subject: [PATCH 2/2] chore(projects): add type hints to create_duplicate_project --- erpnext/projects/doctype/project/project.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py index b0cda8df8f8..0e9e9d11dae 100644 --- a/erpnext/projects/doctype/project/project.py +++ b/erpnext/projects/doctype/project/project.py @@ -590,7 +590,7 @@ def allow_to_make_project_update(project, time, frequency): @frappe.whitelist() -def create_duplicate_project(prev_doc, project_name): +def create_duplicate_project(prev_doc: str | dict, project_name: str): """Create duplicate project based on the old project""" import json