From b5a84c5e65f566c98d5b3d31c362e5b3983a839c Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Sat, 30 May 2026 18:21:11 +0530 Subject: [PATCH] fix: add validation and tests for set_status --- erpnext/support/doctype/issue/issue.py | 1 - erpnext/support/doctype/issue/test_issue.py | 32 +++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/erpnext/support/doctype/issue/issue.py b/erpnext/support/doctype/issue/issue.py index 75822ff2247..7a2414fdc3e 100644 --- a/erpnext/support/doctype/issue/issue.py +++ b/erpnext/support/doctype/issue/issue.py @@ -224,7 +224,6 @@ def set_multiple_status(names: str, status: str): @frappe.whitelist() def set_status(name: str, status: str): frappe.has_permission("Issue", "write", name, throw=True) - frappe.db.set_value("Issue", name, "status", status) diff --git a/erpnext/support/doctype/issue/test_issue.py b/erpnext/support/doctype/issue/test_issue.py index 24665fff94a..371a9449e8f 100644 --- a/erpnext/support/doctype/issue/test_issue.py +++ b/erpnext/support/doctype/issue/test_issue.py @@ -524,6 +524,38 @@ class TestFirstResponseTime(TestSetUp): ) self.assertEqual(issue.first_response_time, 1.0) + def _get_no_perm_user(self): + email = "test_no_issue_perm@example.com" + if not frappe.db.exists("User", email): + user = frappe.new_doc("User") + user.email = email + user.first_name = "No Perm" + user.send_welcome_email = 0 + user.insert(ignore_permissions=True) + return email + + def test_set_status_requires_write_permission(self): + from erpnext.support.doctype.issue.issue import set_status + + issue = frappe.new_doc("Issue") + issue.subject = "_Test Permission Issue" + issue.insert(ignore_permissions=True) + frappe.set_user(self._get_no_perm_user()) + self.assertRaises(frappe.PermissionError, set_status, issue.name, "Closed") + frappe.set_user("Administrator") + + def test_set_multiple_status_requires_write_permission(self): + import json + + from erpnext.support.doctype.issue.issue import set_multiple_status + + issue = frappe.new_doc("Issue") + issue.subject = "_Test Permission Issue" + issue.insert(ignore_permissions=True) + frappe.set_user(self._get_no_perm_user()) + self.assertRaises(frappe.PermissionError, set_multiple_status, json.dumps([issue.name]), "Closed") + frappe.set_user("Administrator") + def create_issue_and_communication(issue_creation, first_responded_on): issue = make_issue(issue_creation, index=1)