From 5dbf3fdde0e11fa482a42bfa36559becdc814c6a Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Sun, 31 May 2026 04:40:02 +0530 Subject: [PATCH] fix: add permission checks in accounts whitelisted methods --- erpnext/accounts/doctype/payment_entry/payment_entry.py | 4 ++++ erpnext/accounts/utils.py | 1 + 2 files changed, 5 insertions(+) diff --git a/erpnext/accounts/doctype/payment_entry/payment_entry.py b/erpnext/accounts/doctype/payment_entry/payment_entry.py index 357df56c5e9..9ee7623ad7d 100644 --- a/erpnext/accounts/doctype/payment_entry/payment_entry.py +++ b/erpnext/accounts/doctype/payment_entry/payment_entry.py @@ -2281,6 +2281,9 @@ def get_outstanding_reference_documents(args: str | dict, validate: bool = False if args.get("party_type") == "Member": return + if args.get("party_type") and args.get("party"): + frappe.has_permission(args["party_type"], "read", args["party"], throw=True) + if not args.get("get_outstanding_invoices") and not args.get("get_orders_to_be_billed"): args["get_outstanding_invoices"] = True @@ -2776,6 +2779,7 @@ def get_reference_details( ): total_amount = outstanding_amount = exchange_rate = account = None + frappe.has_permission(reference_doctype, "read", reference_name, throw=True) ref_doc = frappe.get_lazy_doc(reference_doctype, reference_name) company_currency = ref_doc.get("company_currency") or erpnext.get_company_currency(ref_doc.company) diff --git a/erpnext/accounts/utils.py b/erpnext/accounts/utils.py index 9cf6fc225f7..8eeec3b5c84 100644 --- a/erpnext/accounts/utils.py +++ b/erpnext/accounts/utils.py @@ -302,6 +302,7 @@ def get_balance_on( ) if party_type and party: + frappe.has_permission(party_type, "read", party, throw=True) cond.append( f"""gle.party_type = {frappe.db.escape(party_type)} and gle.party = {frappe.db.escape(party)} """ )