fix: check write permission in whitelisted document methods (#58689)

* fix: check write permission in whitelisted document methods

* fix: keep production plan status roll-up permission agnostic

erpnext/crm/doctype/lead/lead.py

@@ -236,6 +236,8 @@ class Lead(SellingController, CRMNote):
 
 	@frappe.whitelist()
 	def create_prospect_and_contact(self, data: dict):
+		self.check_permission("write")
+
 		data = frappe._dict(data)
 		if data.create_contact:
 			self.create_contact()

erpnext/manufacturing/doctype/production_plan/production_plan.py

@@ -373,6 +373,8 @@ class ProductionPlan(Document):
 
 	@frappe.whitelist()
 	def set_status(self, close: bool | None = None, update_bin: bool = False):
+		self.check_permission("write")
+
 		self.status = {0: "Draft", 1: "Submitted", 2: "Cancelled"}.get(self.docstatus)
 
 		if close:

erpnext/manufacturing/doctype/work_order/services/status.py

@@ -308,6 +308,7 @@ class StatusService:
 
 	def update_production_plan_status(self):
 		production_plan = frappe.get_doc("Production Plan", self.doc.production_plan)
+		production_plan.flags.ignore_permissions = True
 		produced_qty = 0
 		if self.doc.production_plan_item:
 			total_qty = frappe.get_all(
@@ -385,6 +386,7 @@ class StatusService:
 			frappe.db.set_value("Production Plan Sub Assembly Item", field, "ordered_qty", qty)
 
 		doc = frappe.get_doc("Production Plan", self.doc.production_plan)
+		doc.flags.ignore_permissions = True
 		doc.set_status()
 		doc.db_set("status", doc.status)
 

erpnext/regional/doctype/import_supplier_invoice/import_supplier_invoice.py

@@ -168,6 +168,8 @@ class ImportSupplierInvoice(Document):
 
 	@frappe.whitelist()
 	def process_file_data(self):
+		self.check_permission("write")
+
 		self.db_set("status", "Processing File Data", notify=True, commit=True)
 		frappe.enqueue_doc(self.doctype, self.name, "import_xml_data", queue="long", timeout=3600)
 

erpnext/stock/doctype/batch/batch.py

@@ -158,6 +158,8 @@ class Batch(Document):
 
 	@frappe.whitelist()
 	def recalculate_batch_qty(self):
+		self.check_permission("write")
+
 		batches = get_batch_qty(
 			batch_no=self.name,
 			item_code=self.item,

erpnext/stock/doctype/material_request/material_request.py

@@ -502,6 +502,7 @@ class MaterialRequest(BuyingController):
 
 		for production_plan in production_plans:
 			doc = frappe.get_doc("Production Plan", production_plan)
+			doc.flags.ignore_permissions = True
 			doc.set_status()
 			doc.db_set("status", doc.status)
 

erpnext/stock/doctype/repost_item_valuation/repost_item_valuation.py

@@ -286,6 +286,8 @@ class RepostItemValuation(Document):
 
 	@frappe.whitelist()
 	def restart_reposting(self):
+		self.check_permission("write")
+
 		self.set_status("Queued", write=False)
 		self.current_index = 0
 		self.distinct_item_and_warehouse = None

erpnext/stock/doctype/stock_closing_entry/stock_closing_entry.py

@@ -151,6 +151,8 @@ class StockClosingEntry(Document):
 
 	@frappe.whitelist(methods=["POST"])
 	def enqueue_job(self):
+		self.check_permission("write")
+
 		self.db_set("status", "In Progress")
 		enqueue(prepare_closing_stock_balance, name=self.name, queue="long", timeout=1500)
 		frappe.msgprint(
@@ -161,6 +163,8 @@ class StockClosingEntry(Document):
 
 	@frappe.whitelist(methods=["POST"])
 	def regenerate_closing_balance(self):
+		self.check_permission("write")
+
 		self.validate_closed_period_lock()
 		self.remove_stock_closing()
 		self.enqueue_job()

erpnext/stock/doctype/stock_reposting_settings/stock_reposting_settings.py

@@ -73,6 +73,8 @@ class StockRepostingSettings(Document):
 	def convert_to_item_wh_reposting(self):
 		"""Convert Transaction reposting to Item Warehouse based reposting if Item Based Reposting has enabled."""
 
+		self.check_permission("write")
+
 		reposting_data = get_reposting_entries()
 
 		vouchers = [d.voucher_no for d in reposting_data]