From 95212e5738426203dd8284473c5cd8e9fa5dc0d8 Mon Sep 17 00:00:00 2001 From: Diptanil Saha Date: Wed, 8 Jul 2026 05:48:35 +0530 Subject: [PATCH] fix(tnc): `get_terms_and_conditions` render_template with `safe_exec` (#56944) --- .../doctype/terms_and_conditions/terms_and_conditions.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py b/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py index f9fd9050d34..5a54f2e7714 100644 --- a/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py +++ b/erpnext/setup/doctype/terms_and_conditions/terms_and_conditions.py @@ -30,7 +30,7 @@ class TermsandConditions(Document): def validate(self): if self.terms: - validate_template(self.terms) + validate_template(self.terms, restrict_globals=True) if not cint(self.buying) and not cint(self.selling) and not cint(self.hr) and not cint(self.disabled): throw(_("At least one of the Applicable Modules should be selected")) @@ -39,7 +39,7 @@ class TermsandConditions(Document): def get_terms_and_conditions(template_name: str, doc: str | dict): doc = frappe.parse_json(doc) - terms_and_conditions = frappe.get_doc("Terms and Conditions", template_name) + terms = frappe.get_cached_value("Terms and Conditions", template_name, "terms") - if terms_and_conditions.terms: - return frappe.render_template(terms_and_conditions.terms, doc) + if terms: + return frappe.render_template(terms, doc, restrict_globals=True)