From 4dd56ec4e6fae71ea112c53770dfd1f6f8c3546b Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Wed, 2 Sep 2026 13:50:38 +0530 Subject: [PATCH] fix(crm): check read permission on lead in add_lead_to_prospect (cherry picked from commit 02fcdc0337b3afab1eafd586c4a3d39444570b11) # Conflicts: # erpnext/crm/doctype/lead/lead.py --- erpnext/crm/doctype/lead/lead.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/erpnext/crm/doctype/lead/lead.py b/erpnext/crm/doctype/lead/lead.py index 42b82395719..79fc7c1c186 100644 --- a/erpnext/crm/doctype/lead/lead.py +++ b/erpnext/crm/doctype/lead/lead.py @@ -516,8 +516,11 @@ def get_lead_with_phone_number(number): return lead -@frappe.whitelist() -def add_lead_to_prospect(lead, prospect): +@frappe.whitelist(methods=["POST"]) +def add_lead_to_prospect(lead: str, prospect: str): + if lead: + frappe.has_permission("Lead", "read", lead, throw=True) + prospect = frappe.get_doc("Prospect", prospect) prospect.append("leads", {"lead": lead}) prospect.save()