nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-15 07:28:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(assets): add permission checks on whitelisted methods on asset_capitalization

Browse Source 
(cherry picked from commit 09d721d1be)
This commit is contained in:
diptanilsaha
2026-07-16 00:47:56 +05:30
parent 2ce88af3c9
commit 99f249b1a0
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
erpnext/assets/doctype/asset_capitalization/asset_capitalization.py
View File

@@ -668,11 +668,13 @@ def get_target_asset_details(asset: str | None = None, company: str | None = Non
@frappe.whitelist() @frappe.whitelist()
@erpnext.normalize_ctx_input(ItemDetailsCtx) @erpnext.normalize_ctx_input(ItemDetailsCtx)
def get_consumed_stock_item_details(ctx: ItemDetailsCtx): def get_consumed_stock_item_details(ctx: ItemDetailsCtx):
frappe.has_permission("Stock Ledger Entry", throw=True)
out = frappe._dict() out = frappe._dict()
item = frappe._dict() item = frappe._dict()
if ctx.item_code: if ctx.item_code:
item = frappe.get_cached_doc("Item", ctx.item_code) item = frappe.get_cached_doc("Item", ctx.item_code)
item.check_permission()
out.item_name = item.item_name out.item_name = item.item_name
out.batch_no = None out.batch_no = None
@@ -682,6 +684,8 @@ def get_consumed_stock_item_details(ctx: ItemDetailsCtx):
out.stock_uom = item.stock_uom out.stock_uom = item.stock_uom
out.warehouse = get_item_warehouse_(ctx, item, overwrite_warehouse=True) if item else None out.warehouse = get_item_warehouse_(ctx, item, overwrite_warehouse=True) if item else None
if out.warehouse:
frappe.has_permission("Warehouse", doc=out.warehouse, throw=True)
# Cost Center # Cost Center
item_defaults = get_item_defaults(item.name, ctx.company) item_defaults = get_item_defaults(item.name, ctx.company)
@@ -722,6 +726,9 @@ def get_warehouse_details(args):
out = {} out = {}
if args.warehouse and args.item_code: if args.warehouse and args.item_code:
frappe.has_permission("Item", doc=args.item_code, throw=True)
frappe.has_permission("Warehouse", doc=args.warehouse, throw=True)
frappe.has_permission("Stock Ledger Entry", throw=True)
out = { out = {
"actual_qty": get_previous_sle(args).get("qty_after_transaction") or 0, "actual_qty": get_previous_sle(args).get("qty_after_transaction") or 0,
"valuation_rate": get_incoming_rate(args, raise_error_if_no_rate=False), "valuation_rate": get_incoming_rate(args, raise_error_if_no_rate=False),