From 5f6952b15c1f6ee893770d5bc618558a6ba41a28 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 08:20:41 +0000 Subject: [PATCH] fix: restrict jinja globals in process statement of accounts templates (backport #56458) (#57232) fix: restrict jinja globals in process statement of accounts templates (cherry picked from commit ecb6d48ec025e0c94abac35b2e4f7607f4c86465) Co-authored-by: Shllokkk --- .../process_statement_of_accounts.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py b/erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py index e861747803e..f1a7351508e 100644 --- a/erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py +++ b/erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py @@ -99,9 +99,9 @@ class ProcessStatementOfAccounts(Document): if not self.pdf_name: self.pdf_name = "{{ customer.customer_name }}" - validate_template(self.subject) - validate_template(self.body) - validate_template(self.pdf_name) + validate_template(self.subject, restrict_globals=True) + validate_template(self.body, restrict_globals=True) + validate_template(self.pdf_name, restrict_globals=True) if not self.customers: frappe.throw(_("Customers not selected.")) @@ -527,15 +527,15 @@ def send_emails(document_name, from_scheduler=False, posting_date=None): if report: for customer, report_pdf in report.items(): context = get_context(customer, doc) - filename = frappe.render_template(doc.pdf_name, context) + filename = frappe.render_template(doc.pdf_name, context, restrict_globals=True) attachments = [{"fname": filename + ".pdf", "fcontent": report_pdf}] recipients, cc = get_recipients_and_cc(customer, doc) if not recipients: continue - subject = frappe.render_template(doc.subject, context) - message = frappe.render_template(doc.body, context) + subject = frappe.render_template(doc.subject, context, restrict_globals=True) + message = frappe.render_template(doc.body, context, restrict_globals=True) if doc.sender: sender_email = frappe.db.get_value("Email Account", doc.sender, "email_id")