nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-27 22:05:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(bank_statement_import): add missing permission check on multiple whitelisted methods (backport #58221) (#58224)

Browse Source 
Co-authored-by: Diptanil Saha <diptanil@frappe.io>
This commit is contained in:
mergify[bot]
2026-08-16 18:03:24 +00:00
committed by GitHub
parent 2b685ed982
commit 81461ea56c
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py
View File

@@ -167,9 +167,10 @@ def get_transaction_reference(txn_data: dict) -> str:
).strip() ).strip()
@frappe.whitelist() @frappe.whitelist(methods=["POST"])
def convert_mt940_to_csv(data_import, mt940_file_path): def convert_mt940_to_csv(data_import, mt940_file_path):
doc = frappe.get_doc("Bank Statement Import", data_import) doc = frappe.get_doc("Bank Statement Import", data_import)
doc.check_permission("write")
_file_doc, content = get_file(mt940_file_path) _file_doc, content = get_file(mt940_file_path)
@@ -234,26 +235,30 @@ def convert_mt940_to_csv(data_import, mt940_file_path):
@frappe.whitelist() @frappe.whitelist()
def get_preview_from_template(data_import, import_file=None, google_sheets_url=None): def get_preview_from_template(data_import, import_file=None, google_sheets_url=None):
return frappe.get_doc("Bank Statement Import", data_import).get_preview_from_template( bsi = frappe.get_doc("Bank Statement Import", data_import)
import_file, google_sheets_url bsi.check_permission()
) return bsi.get_preview_from_template(import_file, google_sheets_url)
@frappe.whitelist() @frappe.whitelist()
def form_start_import(data_import): def form_start_import(data_import):
job_id = frappe.get_doc("Bank Statement Import", data_import).start_import() bsi = frappe.get_doc("Bank Statement Import", data_import)
return job_id is not None bsi.check_permission("write")
return bsi.start_import()
@frappe.whitelist() @frappe.whitelist()
def download_errored_template(data_import_name): def download_errored_template(data_import_name):
data_import = frappe.get_doc("Bank Statement Import", data_import_name) data_import = frappe.get_doc("Bank Statement Import", data_import_name)
data_import.check_permission()
data_import.export_errored_rows() data_import.export_errored_rows()
@frappe.whitelist() @frappe.whitelist()
def download_import_log(data_import_name): def download_import_log(data_import_name):
return frappe.get_doc("Bank Statement Import", data_import_name).download_import_log() bsi = frappe.get_doc("Bank Statement Import", data_import_name)
bsi.check_permission()
return bsi.download_import_log()
def is_mt940_format(content: str) -> bool: def is_mt940_format(content: str) -> bool: