From 4355f8e60e13845211e473dc37d78d5e9696bcf6 Mon Sep 17 00:00:00 2001 From: Diptanil Saha Date: Mon, 31 Aug 2026 13:23:59 +0530 Subject: [PATCH] fix(pos): add permission checks on `get_invoices` (#58591) --- .../accounts/doctype/pos_closing_entry/pos_closing_entry.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py b/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py index 9914d78aa1a..68d7fc0150d 100644 --- a/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py +++ b/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py @@ -263,12 +263,15 @@ def get_cashiers(doctype: str, txt: str, searchfield: str, start: int, page_len: @frappe.whitelist() def get_invoices(start: str | datetime, end: str | datetime, pos_profile: str, user: str): invoice_doctype = frappe.db.get_single_value("POS Settings", "invoice_type") + frappe.has_permission("POS Profile", doc=pos_profile, throw=True) + frappe.has_permission("Sales Invoice", throw=True) sales_inv_query = build_invoice_query("Sales Invoice", user, pos_profile, start, end) query = sales_inv_query if invoice_doctype == "POS Invoice": + frappe.has_permission("POS Invoice", throw=True) pos_inv_query = build_invoice_query("POS Invoice", user, pos_profile, start, end) query = query + pos_inv_query