nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-20 01:39:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(accounts): disallow reversing a reverse journal entry

Browse Source 
check read permission on the source entry before the guards run, so the reversal relationship is not disclosed to a user who cannot read it.
This commit is contained in:
pandiyan
2026-08-12 15:59:16 +05:30
parent 80422d2108
commit 9dd37d5f32
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/accounts/doctype/journal_entry/journal_entry.js
View File

@@ -249,7 +249,7 @@ Object.assign(erpnext.journal_entry, {
);
}
if (frm.doc.docstatus == 1) {
if (frm.doc.docstatus == 1 && !frm.doc.reversal_of) {
frm.add_custom_button(
__("Reverse Journal Entry"),
() => erpnext.journal_entry.reverse_journal_entry(frm),

14
erpnext/accounts/doctype/journal_entry/mapper.py
View File

@@ -222,6 +222,20 @@ def make_inter_company_journal_entry(name: str, voucher_type: str, company: str)
@frappe.whitelist()
def make_reverse_journal_entry(source_name: str, target_doc: str | dict | Document | None = None) -> Document:
"""Map a submitted Journal Entry to a reversing one (debits and credits swapped)."""
# `get_mapped_doc` checks this as well, but the guards below disclose which entry
# reverses which, so read access has to be settled before they run
if not frappe.has_permission("Journal Entry", doc=source_name):
frappe.throw(_("Not permitted"), frappe.PermissionError)
reversal_of = frappe.db.get_value("Journal Entry", source_name, "reversal_of")
if reversal_of:
frappe.throw(
_("{0} is already a Reverse Journal Entry of {1}. Cancel it instead of reversing it.").format(
get_link_to_form("Journal Entry", source_name),
get_link_to_form("Journal Entry", reversal_of),
)
)
existing_reverse = frappe.db.exists("Journal Entry", {"reversal_of": source_name, "docstatus": 1})
if existing_reverse:
frappe.throw(