nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-16 07:58:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: restrict jinja globals in process statement of accounts templates (backport #56458) (#57231)

Browse Source 
Co-authored-by: Shllokkk <shllokosan23@gmail.com>
This commit is contained in:
mergify[bot]
2026-07-17 08:25:47 +00:00
committed by GitHub
parent 5e539643ec
commit 88443e4a97
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py
View File

@@ -97,9 +97,9 @@ class ProcessStatementOfAccounts(Document):
if not self.pdf_name: if not self.pdf_name:
self.pdf_name = "{{ customer.customer_name }}" self.pdf_name = "{{ customer.customer_name }}"
validate_template(self.subject) validate_template(self.subject, restrict_globals=True)
validate_template(self.body) validate_template(self.body, restrict_globals=True)
validate_template(self.pdf_name) validate_template(self.pdf_name, restrict_globals=True)
if not self.customers: if not self.customers:
frappe.throw(_("Customers not selected.")) frappe.throw(_("Customers not selected."))
@@ -501,15 +501,15 @@ def send_emails(document_name, from_scheduler=False, posting_date=None):
if report: if report:
for customer, report_pdf in report.items(): for customer, report_pdf in report.items():
context = get_context(customer, doc) context = get_context(customer, doc)
filename = frappe.render_template(doc.pdf_name, context) filename = frappe.render_template(doc.pdf_name, context, restrict_globals=True)
attachments = [{"fname": filename + ".pdf", "fcontent": report_pdf}] attachments = [{"fname": filename + ".pdf", "fcontent": report_pdf}]
recipients, cc = get_recipients_and_cc(customer, doc) recipients, cc = get_recipients_and_cc(customer, doc)
if not recipients: if not recipients:
continue continue
subject = frappe.render_template(doc.subject, context) subject = frappe.render_template(doc.subject, context, restrict_globals=True)
message = frappe.render_template(doc.body, context) message = frappe.render_template(doc.body, context, restrict_globals=True)
if doc.sender: if doc.sender:
sender_email = frappe.db.get_value("Email Account", doc.sender, "email_id") sender_email = frappe.db.get_value("Email Account", doc.sender, "email_id")