fix: add missing perm checks on various whitelisted methods (backport #58652) (#58654)

Co-authored-by: Diptanil Saha <diptanil@frappe.io>

erpnext/accounts/doctype/ledger_merge/ledger_merge.py

@@ -56,7 +56,9 @@ class LedgerMerge(Document):
 
 @frappe.whitelist()
 def form_start_merge(docname):
-	return frappe.get_doc("Ledger Merge", docname).start_merge()
+	lm_doc = frappe.get_doc("Ledger Merge", docname)
+	lm_doc.check_permission("write")
+	return lm_doc.start_merge()
 
 
 def start_merge(docname):

erpnext/accounts/doctype/payment_order/payment_order.py

@@ -83,6 +83,7 @@ def get_supplier_query(doctype, txt, searchfield, start, page_len, filters):
 @frappe.whitelist()
 def make_payment_records(name, supplier, mode_of_payment=None):
 	doc = frappe.get_doc("Payment Order", name)
+	doc.check_permission()
 	make_journal_entry(doc, supplier, mode_of_payment)
 
 

erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py

@@ -142,6 +142,8 @@ def start_pcv_processing(docname: str):
 
 @frappe.whitelist()
 def pause_pcv_processing(docname: str):
+	frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True)
+
 	ppcv = qb.DocType("Process Period Closing Voucher")
 	qb.update(ppcv).set(ppcv.status, "Paused").where(ppcv.name.eq(docname)).run()
 
@@ -157,6 +159,8 @@ def pause_pcv_processing(docname: str):
 
 @frappe.whitelist()
 def cancel_pcv_processing(docname: str):
+	frappe.has_permission("Process Period Closing Voucher", ptype="cancel", doc=docname, throw=True)
+
 	ppcv = qb.DocType("Process Period Closing Voucher")
 	qb.update(ppcv).set(ppcv.status, "Cancelled").where(ppcv.name.eq(docname)).run()
 
@@ -171,6 +175,8 @@ def cancel_pcv_processing(docname: str):
 
 @frappe.whitelist()
 def resume_pcv_processing(docname: str):
+	frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True)
+
 	ppcv = qb.DocType("Process Period Closing Voucher")
 	qb.update(ppcv).set(ppcv.status, "Running").where(ppcv.name.eq(docname)).run()
 

erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py

@@ -27,6 +27,7 @@ def start_payment_ledger_repost(docname=None):
 	"""
 	if docname:
 		repost_doc = frappe.get_doc("Repost Payment Ledger", docname)
+		repost_doc.check_permission("submit")
 		if repost_doc.docstatus.is_submitted() and repost_doc.repost_status in ["Queued", "Failed"]:
 			try:
 				for entry in repost_doc.repost_vouchers:

erpnext/projects/doctype/project/project.py

@@ -794,5 +794,6 @@ def calculate_total_purchase_cost(project: str | None = None):
 @frappe.whitelist()
 def update_costing_and_billing(project: str | None = None):
 	project = frappe.get_doc("Project", project)
+	project.check_permission("write")
 	project.update_costing()
 	project.db_update()

erpnext/stock/doctype/delivery_note/delivery_note.py

@@ -1168,6 +1168,7 @@ def make_sales_return(source_name, target_doc=None):
 @frappe.whitelist()
 def update_delivery_note_status(docname, status):
 	dn = frappe.get_lazy_doc("Delivery Note", docname)
+	dn.check_permission("submit")
 	dn.update_status(status)
 
 

erpnext/utilities/bulk_transaction.py

@@ -54,6 +54,7 @@ def transaction_processing(data, from_doctype, to_doctype, args=None):
 
 @frappe.whitelist()
 def retry(date: str | None = None):
+	frappe.only_for("System Manager")
 	if not date:
 		date = today()