nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-27 22:05:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: restrict state-changing whitelisted endpoints to POST (#56858)

Browse Source 
Add methods=["POST"] to 50 whitelisted functions that create or modify
documents (get_doc followed by insert/save/submit), so they can no
longer be invoked via GET requests.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
rohitwaghchaure
2026-07-03 18:47:13 +05:30
committed by GitHub
parent 9c911438f1
commit 341a07dffa
38 changed files with 52 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
erpnext/projects/doctype/project/project.py
View File

@@ -628,7 +628,7 @@ def allow_to_make_project_update(project, time, frequency):
return True
@frappe.whitelist()
@frappe.whitelist(methods=["POST"])
def create_duplicate_project(prev_doc: str | dict, project_name: str):
"""Create duplicate project based on the old project"""
import json
@@ -779,7 +779,7 @@ def create_kanban_board_if_not_exists(project: str):
return True
@frappe.whitelist()
@frappe.whitelist(methods=["POST"])
def set_project_status(project: str, status: str):
"""
set status for project and all related tasks

6
erpnext/projects/doctype/task/task.py
View File

@@ -369,7 +369,7 @@ def get_project(doctype: str, txt: str, searchfield: str, start: int, page_len:
)
@frappe.whitelist()
@frappe.whitelist(methods=["POST"])
def set_multiple_status(names: str | list, status: str):
names = frappe.parse_json(names)
for name in names:
@@ -451,7 +451,7 @@ def get_children(
return tasks
@frappe.whitelist()
@frappe.whitelist(methods=["POST"])
def add_node():
from frappe.desk.treeview import make_tree_args
@@ -465,7 +465,7 @@ def add_node():
frappe.get_doc(args).insert()
@frappe.whitelist()
@frappe.whitelist(methods=["POST"])
def add_multiple_tasks(data: str | list, parent: str):
data = frappe.parse_json(data)
new_doc = {"doctype": "Task", "parent_task": parent if parent != "All Tasks" else ""}