From 33d8b62844a45204b6a72c84f383b5e39e395633 Mon Sep 17 00:00:00 2001 From: Diptanil Saha Date: Mon, 13 Jul 2026 23:22:55 +0530 Subject: [PATCH] fix(tnc): `get_terms_and_conditions` render_template with `safe_exec` (backport #56944) (#56977) (cherry picked from commit 40c85a0087f7974813c962d9754fc782e70cd0ab) # Conflicts: # pyproject.toml --- .../terms_and_conditions/terms_and_conditions.py | 11 +++++++---- pyproject.toml | 9 +++++++++ 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py b/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py index 127517a1e3f..d3d056f3862 100644 --- a/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py +++ b/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py @@ -30,7 +30,7 @@ class TermsandConditions(Document): def validate(self): if self.terms: - validate_template(self.terms) + validate_template(self.terms, restrict_globals=True) if not cint(self.buying) and not cint(self.selling) and not cint(self.hr) and not cint(self.disabled): throw(_("At least one of the Applicable Modules should be selected")) @@ -40,7 +40,10 @@ def get_terms_and_conditions(template_name, doc): if isinstance(doc, str): doc = json.loads(doc) - terms_and_conditions = frappe.get_doc("Terms and Conditions", template_name) + tnc = frappe.get_cached_doc("Terms and Conditions", template_name) + tnc.check_permission() - if terms_and_conditions.terms: - return frappe.render_template(terms_and_conditions.terms, doc) + if not tnc.terms: + return + + return frappe.render_template(tnc.terms, doc, restrict_globals=1) diff --git a/pyproject.toml b/pyproject.toml index f5bc11693a4..338d525ff4d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -29,7 +29,16 @@ requires = ["flit_core >=3.4,<4"] build-backend = "flit_core.buildapi" [tool.bench.frappe-dependencies] +<<<<<<< HEAD frappe = ">=15.40.4,<16.0.0" +======= +frappe = ">=16.21.0,<17.0.0" + +[tool.bench.assets] +build_dir = "./banking" +out_dir = "../erpnext/public/banking" +index_html_path = "../erpnext/www/banking.html" +>>>>>>> 40c85a0087 (fix(tnc): `get_terms_and_conditions` render_template with `safe_exec` (backport #56944) (#56977)) [tool.ruff] line-length = 110