From 8c8b282a2ef5f10a22acc5e009863b313f2450bf Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Fri, 21 Aug 2026 13:17:47 +0530 Subject: [PATCH] fix(projects): check read permission on source in create_duplicate_project --- erpnext/projects/doctype/project/project.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py index ab2dc14b518..53bb7b56036 100644 --- a/erpnext/projects/doctype/project/project.py +++ b/erpnext/projects/doctype/project/project.py @@ -667,6 +667,10 @@ def create_duplicate_project(prev_doc: str | dict, project_name: str): prev_doc = frappe.parse_json(prev_doc) + # prev_doc is caller-supplied, but the tasks below are read from the db by name + if source_name := prev_doc.get("name"): + frappe.has_permission("Project", "read", source_name, throw=True) + if project_name == prev_doc.get("name"): frappe.throw(_("Use a name that is different from previous project name"))