diff --git a/erpnext/accounts/doctype/bank_clearance/bank_clearance.py b/erpnext/accounts/doctype/bank_clearance/bank_clearance.py index f7451830e1d..5b628cd87bf 100644 --- a/erpnext/accounts/doctype/bank_clearance/bank_clearance.py +++ b/erpnext/accounts/doctype/bank_clearance/bank_clearance.py @@ -94,6 +94,7 @@ class BankClearance(Document): invalid_document = [] invalid_cheque_date = [] entries_to_update = [] + self.check_permission("write") def validate_entry(d): is_valid = True diff --git a/erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py b/erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py index 1d8234bce39..6694c02dcda 100644 --- a/erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py +++ b/erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py @@ -518,6 +518,7 @@ def create_internal_transfer( """ bank_transaction = frappe.get_doc("Bank Transaction", bank_transaction_name) + bank_transaction.check_permission("write") bank_account = frappe.get_cached_value("Bank Account", bank_transaction.bank_account, "account") company = frappe.get_cached_value("Account", bank_account, "company") @@ -778,7 +779,6 @@ def create_bulk_payment_entry_and_reconcile( """ Create a payment entry and reconcile it with the bank transaction """ - output = [] for bank_transaction_name in bank_transaction_names: diff --git a/erpnext/accounts/doctype/bank_transaction/bank_transaction.py b/erpnext/accounts/doctype/bank_transaction/bank_transaction.py index c025a415ef7..0c36e7e5297 100644 --- a/erpnext/accounts/doctype/bank_transaction/bank_transaction.py +++ b/erpnext/accounts/doctype/bank_transaction/bank_transaction.py @@ -374,6 +374,7 @@ def unreconcile_transaction(transaction_name: str | int): Else, cancel the individual entries """ transaction = frappe.get_doc("Bank Transaction", transaction_name) + transaction.check_permission("write") vouchers_to_cancel = [] @@ -401,6 +402,7 @@ def unreconcile_transaction_entry(bank_transaction_id: str | int, voucher_type: """ bank_transaction = frappe.get_doc("Bank Transaction", bank_transaction_id) + bank_transaction.check_permission("write") # Find the voucher in the bank transaction and depending on the action, either remove it or cancel the voucher for entry in bank_transaction.payment_entries: diff --git a/erpnext/accounts/doctype/repost_accounting_ledger/repost_accounting_ledger.py b/erpnext/accounts/doctype/repost_accounting_ledger/repost_accounting_ledger.py index fb669323442..fe0647be386 100644 --- a/erpnext/accounts/doctype/repost_accounting_ledger/repost_accounting_ledger.py +++ b/erpnext/accounts/doctype/repost_accounting_ledger/repost_accounting_ledger.py @@ -158,6 +158,7 @@ def start_repost(account_repost_doc: str | None = None) -> None: frappe.flags.through_repost_accounting_ledger = True if account_repost_doc: repost_doc = frappe.get_doc("Repost Accounting Ledger", account_repost_doc) + repost_doc.check_permission("write") if repost_doc.docstatus == 1: # Prevent repost on invoices with deferred accounting diff --git a/erpnext/accounts/party.py b/erpnext/accounts/party.py index be3d142cb18..d38a396e983 100644 --- a/erpnext/accounts/party.py +++ b/erpnext/accounts/party.py @@ -511,6 +511,7 @@ def get_party_advance_account(party_type, party, company): @frappe.whitelist() def get_party_bank_account(party_type: str, party: str): + frappe.has_permission("Bank Account", "read", throw=True) return frappe.db.get_value("Bank Account", {"party_type": party_type, "party": party, "is_default": 1}) diff --git a/erpnext/crm/doctype/lead/mapper.py b/erpnext/crm/doctype/lead/mapper.py index b90fba19a79..c6e7df52557 100644 --- a/erpnext/crm/doctype/lead/mapper.py +++ b/erpnext/crm/doctype/lead/mapper.py @@ -130,7 +130,6 @@ def make_lead_from_communication(communication: str, ignore_communication_links: } ) lead.flags.ignore_mandatory = True - lead.flags.ignore_permissions = True lead.insert() lead_name = lead.name diff --git a/erpnext/crm/doctype/opportunity/mapper.py b/erpnext/crm/doctype/opportunity/mapper.py index 55e081cfb09..e1bdf9a73cd 100644 --- a/erpnext/crm/doctype/opportunity/mapper.py +++ b/erpnext/crm/doctype/opportunity/mapper.py @@ -145,7 +145,7 @@ def make_opportunity_from_communication( "opportunity_from": opportunity_from, "party_name": lead, } - ).insert(ignore_permissions=True) + ).insert() link_communication_to_document(doc, "Opportunity", opportunity.name, ignore_communication_links) diff --git a/erpnext/manufacturing/doctype/bom_creator/bom_creator.py b/erpnext/manufacturing/doctype/bom_creator/bom_creator.py index 2eca7519dfb..531fe9826f9 100644 --- a/erpnext/manufacturing/doctype/bom_creator/bom_creator.py +++ b/erpnext/manufacturing/doctype/bom_creator/bom_creator.py @@ -388,8 +388,6 @@ class BOMCreator(Document): @frappe.whitelist() def edit_bom_creator(self, docname: str, data: str | dict): - frappe.has_permission("BOM Creator", "write", doc=self, throw=True) - if not frappe.db.exists("BOM Creator Item", {"parent": self.name, "name": docname}): frappe.throw(_("BOM Creator Item with name {0} does not exist").format(docname)) @@ -426,8 +424,6 @@ class BOMCreator(Document): @frappe.whitelist() def add_item(self, **kwargs): - frappe.has_permission("BOM Creator", "write", doc=self, throw=True) - if isinstance(kwargs, str): kwargs = frappe.parse_json(kwargs) @@ -458,8 +454,6 @@ class BOMCreator(Document): @frappe.whitelist() def add_sub_assembly(self, **kwargs): - frappe.has_permission("BOM Creator", "write", doc=self, throw=True) - if isinstance(kwargs, str): kwargs = frappe.parse_json(kwargs) @@ -499,7 +493,7 @@ class BOMCreator(Document): else: if sbool(kwargs.phantom): parent_row = next(item for item in self.items if item.name == kwargs.fg_reference_id) - parent_row.db_set("is_phantom_item", 1) + parent_row.is_phantom_item = 1 parent_row_no = get_parent_row_no(self, kwargs.fg_reference_id) for row in bom_item.get("items"): @@ -528,8 +522,6 @@ class BOMCreator(Document): @frappe.whitelist() def delete_node(self, **kwargs): - frappe.has_permission("BOM Creator", "write", doc=self, throw=True) - if isinstance(kwargs, str): kwargs = frappe.parse_json(kwargs) diff --git a/erpnext/manufacturing/doctype/workstation/workstation.py b/erpnext/manufacturing/doctype/workstation/workstation.py index a6c320b7606..4fd4e8651f1 100644 --- a/erpnext/manufacturing/doctype/workstation/workstation.py +++ b/erpnext/manufacturing/doctype/workstation/workstation.py @@ -213,7 +213,7 @@ class Workstation(Document): def start_job(self, job_card: str, from_time: DateTimeLikeObject, employee: str): doc = frappe.get_doc("Job Card", job_card) doc.append("time_logs", {"from_time": from_time, "employee": employee}) - doc.save(ignore_permissions=True) + doc.save() return doc @@ -226,7 +226,7 @@ class Workstation(Document): row.time_in_mins = time_diff_in_hours(row.to_time, row.from_time) / 60 row.completed_qty = qty - doc.save(ignore_permissions=True) + doc.save() doc.submit() return doc diff --git a/erpnext/setup/doctype/transaction_deletion_record/transaction_deletion_record.py b/erpnext/setup/doctype/transaction_deletion_record/transaction_deletion_record.py index 25f5d06d8b4..11341730605 100644 --- a/erpnext/setup/doctype/transaction_deletion_record/transaction_deletion_record.py +++ b/erpnext/setup/doctype/transaction_deletion_record/transaction_deletion_record.py @@ -642,6 +642,8 @@ class TransactionDeletionRecord(Document): @frappe.whitelist() def start_deletion_tasks(self): + self.check_permission("write") + # This method is the entry point for the chain of events that follow self.db_set("status", "Running") self._set_deletion_cache() diff --git a/erpnext/stock/doctype/delivery_trip/delivery_trip.py b/erpnext/stock/doctype/delivery_trip/delivery_trip.py index 48efe8171d0..2e8832771fd 100644 --- a/erpnext/stock/doctype/delivery_trip/delivery_trip.py +++ b/erpnext/stock/doctype/delivery_trip/delivery_trip.py @@ -368,6 +368,8 @@ def get_default_address(out, name): @frappe.whitelist() def get_contact_display(contact: str): + frappe.has_permission("Contact", "read", doc=contact, throw=True) + contact_info = frappe.db.get_value( "Contact", contact, ["first_name", "last_name", "phone", "mobile_no"], as_dict=1 ) @@ -470,6 +472,8 @@ def get_attachments(delivery_stop): @frappe.whitelist() def get_driver_email(driver: str): + frappe.has_permission("Driver", "read", doc=driver, throw=True) + employee = frappe.db.get_value("Driver", driver, "employee") email = frappe.db.get_value("Employee", employee, "prefered_email") return {"email": email} diff --git a/erpnext/stock/doctype/shipment/shipment.py b/erpnext/stock/doctype/shipment/shipment.py index 816293a388a..c72e747ab09 100644 --- a/erpnext/stock/doctype/shipment/shipment.py +++ b/erpnext/stock/doctype/shipment/shipment.py @@ -127,6 +127,8 @@ def get_contact_name(ref_doctype: str, docname: str): @frappe.whitelist() def get_company_contact(user: str): + frappe.has_permission("User", "read", throw=True) + contact = frappe.db.get_value( "User", user, diff --git a/erpnext/stock/report/incorrect_serial_and_batch_bundle/incorrect_serial_and_batch_bundle.py b/erpnext/stock/report/incorrect_serial_and_batch_bundle/incorrect_serial_and_batch_bundle.py index e191da4ff73..2a9640bab9e 100644 --- a/erpnext/stock/report/incorrect_serial_and_batch_bundle/incorrect_serial_and_batch_bundle.py +++ b/erpnext/stock/report/incorrect_serial_and_batch_bundle/incorrect_serial_and_batch_bundle.py @@ -135,11 +135,14 @@ def get_linked_cancelled_sabb(filters): @frappe.whitelist() def fix_sabb_entries(selected_rows: str | list): + frappe.has_permission("Serial and Batch Bundle", "write", throw=True) + if isinstance(selected_rows, str): selected_rows = frappe.parse_json(selected_rows) for row in selected_rows: doc = frappe.get_doc("Serial and Batch Bundle", row.get("name")) + doc.check_permission("write") if doc.is_cancelled == 0 and not frappe.db.get_value( "Stock Ledger Entry", {"serial_and_batch_bundle": doc.name, "is_cancelled": 0}, diff --git a/erpnext/subcontracting/doctype/subcontracting_inward_order/subcontracting_inward_order.py b/erpnext/subcontracting/doctype/subcontracting_inward_order/subcontracting_inward_order.py index 77d7530b3c7..d15ae8beaa6 100644 --- a/erpnext/subcontracting/doctype/subcontracting_inward_order/subcontracting_inward_order.py +++ b/erpnext/subcontracting/doctype/subcontracting_inward_order/subcontracting_inward_order.py @@ -562,4 +562,5 @@ def update_subcontracting_inward_order_status(scio: str | Document, status: str if isinstance(scio, str): scio = frappe.get_doc("Subcontracting Inward Order", scio) + scio.check_permission("write") scio.update_status(status) diff --git a/erpnext/subcontracting/doctype/subcontracting_order/subcontracting_order.py b/erpnext/subcontracting/doctype/subcontracting_order/subcontracting_order.py index f5588d3b064..ff08793e15a 100644 --- a/erpnext/subcontracting/doctype/subcontracting_order/subcontracting_order.py +++ b/erpnext/subcontracting/doctype/subcontracting_order/subcontracting_order.py @@ -484,4 +484,5 @@ def update_subcontracting_order_status(sco: str | Document, status: str | None = if isinstance(sco, str): sco = frappe.get_doc("Subcontracting Order", sco) + sco.check_permission("write") sco.update_status(status) diff --git a/erpnext/support/doctype/issue/issue.py b/erpnext/support/doctype/issue/issue.py index bd4e0eb5767..e43d5977781 100644 --- a/erpnext/support/doctype/issue/issue.py +++ b/erpnext/support/doctype/issue/issue.py @@ -121,6 +121,8 @@ class Issue(Document): def split_issue(self, subject: str, communication_id: str): from copy import deepcopy + self.check_permission("write") + replicated_issue = deepcopy(self) replicated_issue.subject = subject replicated_issue.issue_split_from = self.name @@ -285,7 +287,7 @@ def make_issue_from_communication(communication: str, ignore_communication_links "raised_by": doc.sender or "", "raised_by_phone": doc.phone_no or "", } - ).insert(ignore_permissions=True) + ).insert() link_communication_to_document(doc, "Issue", issue.name, ignore_communication_links)