nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-13 06:31:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(assets): add permission checks on whitelisted methods on asset_capitalization

Browse Source 
(cherry picked from commit 09d721d1be)
This commit is contained in:
diptanilsaha
2026-07-16 00:47:56 +05:30
parent cf42c52530
commit 338fff20db
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
erpnext/assets/doctype/asset_capitalization/asset_capitalization.py
View File

@@ -734,6 +734,7 @@ def get_target_asset_details(asset=None, company=None):
@frappe.whitelist() @frappe.whitelist()
def get_consumed_stock_item_details(args): def get_consumed_stock_item_details(args):
frappe.has_permission("Stock Ledger Entry", throw=True)
if isinstance(args, str): if isinstance(args, str):
args = json.loads(args) args = json.loads(args)
@@ -743,6 +744,7 @@ def get_consumed_stock_item_details(args):
item = frappe._dict() item = frappe._dict()
if args.item_code: if args.item_code:
item = frappe.get_cached_doc("Item", args.item_code) item = frappe.get_cached_doc("Item", args.item_code)
item.check_permission()
out.item_name = item.item_name out.item_name = item.item_name
out.batch_no = None out.batch_no = None
@@ -752,6 +754,8 @@ def get_consumed_stock_item_details(args):
out.stock_uom = item.stock_uom out.stock_uom = item.stock_uom
out.warehouse = get_item_warehouse(item, args, overwrite_warehouse=True) if item else None out.warehouse = get_item_warehouse(item, args, overwrite_warehouse=True) if item else None
if out.warehouse:
frappe.has_permission("Warehouse", doc=out.warehouse, throw=True)
# Cost Center # Cost Center
item_defaults = get_item_defaults(item.name, args.company) item_defaults = get_item_defaults(item.name, args.company)
@@ -792,6 +796,9 @@ def get_warehouse_details(args):
out = {} out = {}
if args.warehouse and args.item_code: if args.warehouse and args.item_code:
frappe.has_permission("Item", doc=args.item_code, throw=True)
frappe.has_permission("Warehouse", doc=args.warehouse, throw=True)
frappe.has_permission("Stock Ledger Entry", throw=True)
out = { out = {
"actual_qty": get_previous_sle(args).get("qty_after_transaction") or 0, "actual_qty": get_previous_sle(args).get("qty_after_transaction") or 0,
"valuation_rate": get_incoming_rate(args, raise_error_if_no_rate=False), "valuation_rate": get_incoming_rate(args, raise_error_if_no_rate=False),