From 86e94803629ea5668c2fc2d18afb5ca59fe2cf03 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Tue, 1 Sep 2026 14:01:40 +0000 Subject: [PATCH] fix: add missing perm checks on various whitelisted methods (backport #58652) (#58654) Co-authored-by: Diptanil Saha --- erpnext/accounts/doctype/ledger_merge/ledger_merge.py | 4 +++- erpnext/accounts/doctype/payment_order/payment_order.py | 1 + .../process_period_closing_voucher.py | 6 ++++++ .../doctype/repost_payment_ledger/repost_payment_ledger.py | 1 + erpnext/projects/doctype/project/project.py | 1 + erpnext/stock/doctype/delivery_note/delivery_note.py | 1 + erpnext/utilities/bulk_transaction.py | 1 + 7 files changed, 14 insertions(+), 1 deletion(-) diff --git a/erpnext/accounts/doctype/ledger_merge/ledger_merge.py b/erpnext/accounts/doctype/ledger_merge/ledger_merge.py index dc3fd5a9d04..d7948d2057c 100644 --- a/erpnext/accounts/doctype/ledger_merge/ledger_merge.py +++ b/erpnext/accounts/doctype/ledger_merge/ledger_merge.py @@ -56,7 +56,9 @@ class LedgerMerge(Document): @frappe.whitelist() def form_start_merge(docname): - return frappe.get_doc("Ledger Merge", docname).start_merge() + lm_doc = frappe.get_doc("Ledger Merge", docname) + lm_doc.check_permission("write") + return lm_doc.start_merge() def start_merge(docname): diff --git a/erpnext/accounts/doctype/payment_order/payment_order.py b/erpnext/accounts/doctype/payment_order/payment_order.py index a4c596249b1..05af90fd9fb 100644 --- a/erpnext/accounts/doctype/payment_order/payment_order.py +++ b/erpnext/accounts/doctype/payment_order/payment_order.py @@ -83,6 +83,7 @@ def get_supplier_query(doctype, txt, searchfield, start, page_len, filters): @frappe.whitelist() def make_payment_records(name, supplier, mode_of_payment=None): doc = frappe.get_doc("Payment Order", name) + doc.check_permission() make_journal_entry(doc, supplier, mode_of_payment) diff --git a/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py b/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py index be6f8ddfbbb..10cf04edb44 100644 --- a/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py +++ b/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py @@ -142,6 +142,8 @@ def start_pcv_processing(docname: str): @frappe.whitelist() def pause_pcv_processing(docname: str): + frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True) + ppcv = qb.DocType("Process Period Closing Voucher") qb.update(ppcv).set(ppcv.status, "Paused").where(ppcv.name.eq(docname)).run() @@ -157,6 +159,8 @@ def pause_pcv_processing(docname: str): @frappe.whitelist() def cancel_pcv_processing(docname: str): + frappe.has_permission("Process Period Closing Voucher", ptype="cancel", doc=docname, throw=True) + ppcv = qb.DocType("Process Period Closing Voucher") qb.update(ppcv).set(ppcv.status, "Cancelled").where(ppcv.name.eq(docname)).run() @@ -171,6 +175,8 @@ def cancel_pcv_processing(docname: str): @frappe.whitelist() def resume_pcv_processing(docname: str): + frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True) + ppcv = qb.DocType("Process Period Closing Voucher") qb.update(ppcv).set(ppcv.status, "Running").where(ppcv.name.eq(docname)).run() diff --git a/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py b/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py index 6fd1b0f2bf2..be896b6f143 100644 --- a/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py +++ b/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py @@ -27,6 +27,7 @@ def start_payment_ledger_repost(docname=None): """ if docname: repost_doc = frappe.get_doc("Repost Payment Ledger", docname) + repost_doc.check_permission("submit") if repost_doc.docstatus.is_submitted() and repost_doc.repost_status in ["Queued", "Failed"]: try: for entry in repost_doc.repost_vouchers: diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py index 3ad039c5c4c..7a1aca40edb 100644 --- a/erpnext/projects/doctype/project/project.py +++ b/erpnext/projects/doctype/project/project.py @@ -794,5 +794,6 @@ def calculate_total_purchase_cost(project: str | None = None): @frappe.whitelist() def update_costing_and_billing(project: str | None = None): project = frappe.get_doc("Project", project) + project.check_permission("write") project.update_costing() project.db_update() diff --git a/erpnext/stock/doctype/delivery_note/delivery_note.py b/erpnext/stock/doctype/delivery_note/delivery_note.py index cc0650aee3b..facbcebac8a 100644 --- a/erpnext/stock/doctype/delivery_note/delivery_note.py +++ b/erpnext/stock/doctype/delivery_note/delivery_note.py @@ -1168,6 +1168,7 @@ def make_sales_return(source_name, target_doc=None): @frappe.whitelist() def update_delivery_note_status(docname, status): dn = frappe.get_lazy_doc("Delivery Note", docname) + dn.check_permission("submit") dn.update_status(status) diff --git a/erpnext/utilities/bulk_transaction.py b/erpnext/utilities/bulk_transaction.py index 636a660575c..b2d3ae1c7f4 100644 --- a/erpnext/utilities/bulk_transaction.py +++ b/erpnext/utilities/bulk_transaction.py @@ -54,6 +54,7 @@ def transaction_processing(data, from_doctype, to_doctype, args=None): @frappe.whitelist() def retry(date: str | None = None): + frappe.only_for("System Manager") if not date: date = today()