From 2cc1a51d9a08495ff1de10d6ffccc5c7e5b8e474 Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Wed, 2 Sep 2026 13:50:38 +0530 Subject: [PATCH] fix(crm): check read permission on lead in add_lead_to_prospect (cherry picked from commit 02fcdc0337b3afab1eafd586c4a3d39444570b11) # Conflicts: # erpnext/crm/doctype/lead/lead.py --- erpnext/crm/doctype/lead/lead.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/erpnext/crm/doctype/lead/lead.py b/erpnext/crm/doctype/lead/lead.py index d970cffa990..bd89193f1b6 100644 --- a/erpnext/crm/doctype/lead/lead.py +++ b/erpnext/crm/doctype/lead/lead.py @@ -526,8 +526,11 @@ def get_lead_with_phone_number(number): return lead -@frappe.whitelist() -def add_lead_to_prospect(lead, prospect): +@frappe.whitelist(methods=["POST"]) +def add_lead_to_prospect(lead: str, prospect: str): + if lead: + frappe.has_permission("Lead", "read", lead, throw=True) + prospect = frappe.get_doc("Prospect", prospect) prospect.append("leads", {"lead": lead}) prospect.save()