fix(setup): strict permissions for transaction deletion record (backport #58687) (#58722)

Co-authored-by: Diptanil Saha <diptanil@frappe.io>

erpnext/setup/doctype/company/company.py

@@ -986,8 +986,12 @@ def get_billing_shipping_address(name, billing_address=None, shipping_address=No
 	return {"primary_address": primary_address, "shipping_address": shipping_address}
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def create_transaction_deletion_request(company):
+	frappe.only_for("System Manager")
+	# User Permission check
+	frappe.has_permission("Company", ptype="delete", doc=company, throw=True)
+
 	from erpnext.setup.doctype.transaction_deletion_record.transaction_deletion_record import (
 		is_deletion_doc_running,
 	)
@@ -995,6 +999,7 @@ def create_transaction_deletion_request(company):
 	is_deletion_doc_running(company)
 
 	tdr = frappe.get_doc({"doctype": "Transaction Deletion Record", "company": company})
+
 	tdr.submit()
 	tdr.start_deletion_tasks()
 

erpnext/setup/doctype/transaction_deletion_record/transaction_deletion_record.json

@@ -1,5 +1,6 @@
 {
  "actions": [],
+ "allow_bulk_edit": 1,
  "autoname": "TDL.####",
  "creation": "2021-04-06 20:17:18.404716",
  "doctype": "DocType",
@@ -141,19 +142,18 @@
    "read_only": 1
   }
  ],
+ "in_create": 1,
  "index_web_pages_for_search": 1,
  "is_submittable": 1,
  "links": [],
- "modified": "2024-03-21 10:29:19.456413",
+ "modified": "2026-09-02 20:32:19.679290",
  "modified_by": "Administrator",
  "module": "Setup",
  "name": "Transaction Deletion Record",
- "naming_rule": "Expression (old style)",
+ "naming_rule": "Expression",
  "owner": "Administrator",
  "permissions": [
   {
-   "create": 1,
-   "delete": 1,
    "email": 1,
    "export": 1,
    "print": 1,
@@ -161,7 +161,6 @@
    "report": 1,
    "role": "System Manager",
    "share": 1,
-   "submit": 1,
    "write": 1
   }
  ],
@@ -169,4 +168,4 @@
  "sort_order": "DESC",
  "states": [],
  "track_changes": 1
-}
+}