Merge pull request #57691 from frappe/mergify/bp/version-15-hotfix/pr-57201

fix: permission checks on various whitelisted methods (backport #57201)

erpnext/accounts/doctype/payment_request/payment_request.js

@@ -33,6 +33,8 @@ frappe.ui.form.on("Payment Request", "onload", function (frm, dt, dn) {
 });
 
 frappe.ui.form.on("Payment Request", "refresh", function (frm) {
+	let sending_email = false;
+
 	if (
 		frm.doc.payment_request_type == "Inward" &&
 		frm.doc.payment_channel !== "Phone" &&
@@ -41,16 +43,16 @@ frappe.ui.form.on("Payment Request", "refresh", function (frm) {
 		frm.doc.docstatus == 1
 	) {
 		frm.add_custom_button(__("Resend Payment Email"), function () {
-			frappe.call({
+			if (sending_email) {
-				method: "erpnext.accounts.doctype.payment_request.payment_request.resend_payment_email",
+				frappe.show_alert({ message: __("Sending Email"), indicator: "blue" });
-				args: { docname: frm.doc.name },
+				return;
-				freeze: true,
+			}
-				freeze_message: __("Sending"),
+			sending_email = true;
-				callback: function (r) {
+			frappe.show_alert({ message: __("Sending Email"), indicator: "blue" });
-					if (!r.exc) {
+			frm.call("resend_payment_email").then((r) => {
-						frappe.msgprint(__("Message Sent"));
+				const msg = !r.exc ? __("Email Sent") : __("Email couldn't be sent.");
-					}
+				frappe.show_alert({ message: msg, indicator: !r.exc ? "green" : "red" });
-				},
+				sending_email = false;
 			});
 		});
 	}

erpnext/accounts/doctype/payment_request/payment_request.py

@@ -411,6 +411,18 @@ class PaymentRequest(Document):
 
 		return payment_entry
 
+	@frappe.whitelist(methods=["POST"])
+	def resend_payment_email(self):
+		if not (
+			self.docstatus == 1
+			and self.payment_request_type == "Inward"
+			and self.payment_channel != "Phone"
+			and self.status not in ["Initiated", "Paid"]
+		):
+			frappe.throw(_("Payment Link couldn't be sent."))
+
+		self.send_email()
+
 	def send_email(self):
 		"""send email with payment link"""
 		email_args = {
@@ -428,7 +440,17 @@ class PaymentRequest(Document):
 				)
 			],
 		}
-		enqueue(method=frappe.sendmail, queue="short", timeout=300, is_async=True, **email_args)
+		job_id = f"send_payment_email::{self.name}"
+		enqueue(
+			method=frappe.sendmail,
+			queue="short",
+			timeout=300,
+			is_async=True,
+			job_id=job_id,
+			deduplicate=True,
+			enqueue_after_commit=True,
+			**email_args,
+		)
 
 	def get_message(self):
 		"""return message with payment gateway link"""
@@ -827,11 +849,6 @@ def get_print_format_list(ref_doctype):
 	return {"print_format": print_format_list}
 
 
-@frappe.whitelist()
-def resend_payment_email(docname):
-	return frappe.get_doc("Payment Request", docname).send_email()
-
-
 @frappe.whitelist()
 def make_payment_entry(docname):
 	doc = frappe.get_doc("Payment Request", docname)

erpnext/assets/doctype/asset_capitalization/asset_capitalization.py

@@ -734,6 +734,7 @@ def get_target_asset_details(asset=None, company=None):
 
 @frappe.whitelist()
 def get_consumed_stock_item_details(args):
+	frappe.has_permission("Stock Ledger Entry", throw=True)
 	if isinstance(args, str):
 		args = json.loads(args)
 
@@ -743,6 +744,7 @@ def get_consumed_stock_item_details(args):
 	item = frappe._dict()
 	if args.item_code:
 		item = frappe.get_cached_doc("Item", args.item_code)
+		item.check_permission()
 
 	out.item_name = item.item_name
 	out.batch_no = None
@@ -752,6 +754,8 @@ def get_consumed_stock_item_details(args):
 	out.stock_uom = item.stock_uom
 
 	out.warehouse = get_item_warehouse(item, args, overwrite_warehouse=True) if item else None
+	if out.warehouse:
+		frappe.has_permission("Warehouse", doc=out.warehouse, throw=True)
 
 	# Cost Center
 	item_defaults = get_item_defaults(item.name, args.company)
@@ -792,6 +796,9 @@ def get_warehouse_details(args):
 
 	out = {}
 	if args.warehouse and args.item_code:
+		frappe.has_permission("Item", doc=args.item_code, throw=True)
+		frappe.has_permission("Warehouse", doc=args.warehouse, throw=True)
+		frappe.has_permission("Stock Ledger Entry", throw=True)
 		out = {
 			"actual_qty": get_previous_sle(args).get("qty_after_transaction") or 0,
 			"valuation_rate": get_incoming_rate(args, raise_error_if_no_rate=False),

erpnext/controllers/item_variant.py

@@ -336,6 +336,7 @@ def create_variant(item, args, use_template_image=False):
 
 @frappe.whitelist()
 def enqueue_multiple_variant_creation(item, args, use_template_image=False):
+	frappe.has_permission("Item", ptype="create", throw=True)
 	use_template_image = frappe.parse_json(use_template_image)
 	# There can be innumerable attribute combinations, enqueue
 	if isinstance(args, str):