nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-15 15:38:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: drop Customer's unused level-1 Sales User read grant

Browse Source 
Makes visibility uniform across the three masters: only the
master-manager role can see or edit company restriction fields.
This commit is contained in:
Mihir Kandoi
2026-07-23 12:12:49 +05:30
parent 565220ebe5
commit 41fc23b9b2
2 changed files with 26 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
erpnext/selling/doctype/customer/customer.json
View File

@@ -727,7 +727,7 @@
"link_fieldname": "party"
}
],
"modified": "2026-07-23 10:00:00.000000",
"modified": "2026-07-23 12:00:00.000000",
"modified_by": "Administrator",
"module": "Selling",
"name": "Customer",
@@ -744,11 +744,6 @@
"share": 1,
"write": 1
},
{
"permlevel": 1,
"read": 1,
"role": "Sales User"
},
{
"email": 1,
"print": 1,

36
erpnext/stock/doctype/company_restriction/test_company_restriction.py
View File

@@ -80,22 +80,36 @@ class TestCompanyRestriction(ERPNextTestSuite):
stock_entry.reload()
stock_entry.cancel()
def make_user_with_roles(self, email, roles):
if not frappe.db.exists("User", email):
frappe.get_doc(
{
"doctype": "User",
"email": email,
"first_name": email.split("@")[0],
"roles": [{"role": role} for role in roles],
}
).insert(ignore_permissions=True)
return email
def test_restriction_fields_require_permlevel_access(self):
customer = make_customer("_Test Permlevel Restricted Customer")
self.restrict_to_companies("Customer", customer, ["_Test Company"])
user = "test_company_restriction_perm@example.com"
if not frappe.db.exists("User", user):
frappe.get_doc(
{
"doctype": "User",
"email": user,
"first_name": "Company Restriction Perm",
"roles": [{"role": "Sales User"}],
}
).insert(ignore_permissions=True)
sales_user = self.make_user_with_roles("test_company_restriction_sales@example.com", ["Sales User"])
manager = self.make_user_with_roles(
"test_company_restriction_manager@example.com", ["Sales User", "Sales Master Manager"]
)
frappe.set_user(user)
permitted = frappe.get_meta("Customer").get_permitted_fieldnames(user=sales_user)
self.assertNotIn("restrict_to_companies", permitted)
self.assertNotIn("allowed_companies", permitted)
permitted = frappe.get_meta("Customer").get_permitted_fieldnames(user=manager)
self.assertIn("restrict_to_companies", permitted)
self.assertIn("allowed_companies", permitted)
frappe.set_user(sales_user)
self.addCleanup(frappe.set_user, "Administrator")
doc = frappe.get_doc("Customer", customer)