From a20fc4f9317ecc7d262625aea680c9a0cda98cef Mon Sep 17 00:00:00 2001 From: Diptanil Saha Date: Tue, 1 Sep 2026 19:12:21 +0530 Subject: [PATCH] fix: add missing perm checks on various whitelisted methods (#58652) --- erpnext/accounts/doctype/ledger_merge/ledger_merge.py | 4 +++- erpnext/accounts/doctype/payment_order/payment_order.py | 1 + .../process_period_closing_voucher.py | 6 ++++++ .../doctype/repost_payment_ledger/repost_payment_ledger.py | 1 + erpnext/projects/doctype/project/project.py | 1 + erpnext/stock/doctype/delivery_note/delivery_note.py | 1 + erpnext/utilities/bulk_transaction.py | 1 + 7 files changed, 14 insertions(+), 1 deletion(-) diff --git a/erpnext/accounts/doctype/ledger_merge/ledger_merge.py b/erpnext/accounts/doctype/ledger_merge/ledger_merge.py index cd574eafaa3..5117ddd3c27 100644 --- a/erpnext/accounts/doctype/ledger_merge/ledger_merge.py +++ b/erpnext/accounts/doctype/ledger_merge/ledger_merge.py @@ -56,7 +56,9 @@ class LedgerMerge(Document): @frappe.whitelist() def form_start_merge(docname: str): - return frappe.get_doc("Ledger Merge", docname).start_merge() + lm_doc = frappe.get_doc("Ledger Merge", docname) + lm_doc.check_permission("write") + return lm_doc.start_merge() def start_merge(docname): diff --git a/erpnext/accounts/doctype/payment_order/payment_order.py b/erpnext/accounts/doctype/payment_order/payment_order.py index d75bce51a4f..7bc7ae1010b 100644 --- a/erpnext/accounts/doctype/payment_order/payment_order.py +++ b/erpnext/accounts/doctype/payment_order/payment_order.py @@ -92,6 +92,7 @@ def get_supplier_query(doctype: str, txt: str, searchfield: str, start: int, pag @frappe.whitelist() def make_payment_records(name: str, supplier: str, mode_of_payment: str | None = None): doc = frappe.get_doc("Payment Order", name) + doc.check_permission() make_journal_entry(doc, supplier, mode_of_payment) diff --git a/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py b/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py index d2cea78a8f0..fda57a87086 100644 --- a/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py +++ b/erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py @@ -142,6 +142,8 @@ def start_pcv_processing(docname: str): @frappe.whitelist() def pause_pcv_processing(docname: str): + frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True) + ppcv = qb.DocType("Process Period Closing Voucher") qb.update(ppcv).set(ppcv.status, "Paused").where(ppcv.name.eq(docname)).run() @@ -157,6 +159,8 @@ def pause_pcv_processing(docname: str): @frappe.whitelist() def cancel_pcv_processing(docname: str): + frappe.has_permission("Process Period Closing Voucher", ptype="cancel", doc=docname, throw=True) + ppcv = qb.DocType("Process Period Closing Voucher") qb.update(ppcv).set(ppcv.status, "Cancelled").where(ppcv.name.eq(docname)).run() @@ -171,6 +175,8 @@ def cancel_pcv_processing(docname: str): @frappe.whitelist() def resume_pcv_processing(docname: str): + frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True) + ppcv = qb.DocType("Process Period Closing Voucher") qb.update(ppcv).set(ppcv.status, "Running").where(ppcv.name.eq(docname)).run() diff --git a/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py b/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py index 5f2ec5316ff..a159e4de605 100644 --- a/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py +++ b/erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py @@ -27,6 +27,7 @@ def start_payment_ledger_repost(docname: str | None = None): """ if docname: repost_doc = frappe.get_doc("Repost Payment Ledger", docname) + repost_doc.check_permission("submit") if repost_doc.docstatus.is_submitted() and repost_doc.repost_status in ["Queued", "Failed"]: try: for entry in repost_doc.repost_vouchers: diff --git a/erpnext/projects/doctype/project/project.py b/erpnext/projects/doctype/project/project.py index 53bb7b56036..cf11cd0b992 100644 --- a/erpnext/projects/doctype/project/project.py +++ b/erpnext/projects/doctype/project/project.py @@ -865,5 +865,6 @@ def calculate_total_purchase_cost(project: str | None = None): @frappe.whitelist() def update_costing_and_billing(project: str | None = None): project = frappe.get_doc("Project", project) + project.check_permission("write") project.update_costing() project.db_update() diff --git a/erpnext/stock/doctype/delivery_note/delivery_note.py b/erpnext/stock/doctype/delivery_note/delivery_note.py index 14ef9971502..25ec176faf3 100644 --- a/erpnext/stock/doctype/delivery_note/delivery_note.py +++ b/erpnext/stock/doctype/delivery_note/delivery_note.py @@ -655,4 +655,5 @@ def get_list_context(context=None): @frappe.whitelist() def update_delivery_note_status(docname: str, status: str): dn = frappe.get_lazy_doc("Delivery Note", docname) + dn.check_permission("submit") dn.update_status(status) diff --git a/erpnext/utilities/bulk_transaction.py b/erpnext/utilities/bulk_transaction.py index 486f2430091..d1e383cda9d 100644 --- a/erpnext/utilities/bulk_transaction.py +++ b/erpnext/utilities/bulk_transaction.py @@ -52,6 +52,7 @@ def transaction_processing( @frappe.whitelist() def retry(date: str | None = None): + frappe.only_for("System Manager") if not date: date = today()