-
- ${customer_name}
+ ${frappe.utils.escape_html(customer_name)}
${get_customer_description()}
+
@@ -473,11 +473,13 @@ erpnext.PointOfSale.ItemCart = class {
if (!email_id && !mobile_no) {
return `
`;
+ return `})
`;
} else {
- return `
@@ -636,7 +645,7 @@ erpnext.PointOfSale.ItemCart = class {
if (item_data.rate && item_data.amount && item_data.rate !== item_data.amount) {
return `
${__("Click to add email / phone")}
`;
} else if (email_id && !mobile_no) {
- return `${email_id}
`;
+ return `${frappe.utils.escape_html(email_id)}
`;
} else if (mobile_no && !email_id) {
- return `${mobile_no}
`;
+ return `${frappe.utils.escape_html(mobile_no)}
`;
} else {
- return `${email_id} - ${mobile_no}
`;
+ return `${frappe.utils.escape_html(
+ email_id
+ )} - ${frappe.utils.escape_html(mobile_no)}
`;
}
}
}
@@ -485,9 +487,13 @@ erpnext.PointOfSale.ItemCart = class {
get_customer_image() {
const { customer, image } = this.customer_info || {};
if (image) {
- return `${frappe.get_abbr(customer)}
`;
+ return `${frappe.utils.escape_html(
+ frappe.get_abbr(customer)
+ )}
`;
}
}
@@ -549,10 +555,10 @@ erpnext.PointOfSale.ItemCart = class {
if (t.tax_amount_after_discount_amount == 0.0) return;
// if tax rate is 0, don't print it.
const description = /[0-9]+/.test(t.description)
- ? t.description
+ ? frappe.utils.escape_html(t.description)
: t.rate != 0
- ? `${t.description} @ ${t.rate}%`
- : t.description;
+ ? `${frappe.utils.escape_html(t.description)} @ ${t.rate}%`
+ : frappe.utils.escape_html(t.description);
return `${description}
${format_currency(t.tax_amount_after_discount_amount, currency)}
@@ -566,8 +572,9 @@ erpnext.PointOfSale.ItemCart = class {
}
get_cart_item({ name }) {
- const item_selector = `.cart-item-wrapper[data-row-name="${escape(name)}"]`;
- return this.$cart_items_wrapper.find(item_selector);
+ return this.$cart_items_wrapper.find(".cart-item-wrapper").filter(function () {
+ return $(this).attr("data-row-name") === name;
+ });
}
get_item_from_frm(item) {
@@ -597,7 +604,9 @@ erpnext.PointOfSale.ItemCart = class {
if (!$item_to_update.length) {
this.$cart_items_wrapper.append(
- `
+ `
`
);
$item_to_update = this.get_cart_item(item_data);
@@ -607,7 +616,7 @@ erpnext.PointOfSale.ItemCart = class {
`${get_item_image_html()}
- ${item_data.item_name}
+ ${frappe.utils.escape_html(item_data.item_name)}
${get_description_html()}
-
${item_data.qty || 0} ${item_data.uom}
+ ${item_data.qty || 0} ${frappe.utils.escape_html(item_data.uom)}
${format_currency(item_data.amount, currency)}
${format_currency(item_data.rate, currency)}
@@ -645,7 +654,7 @@ erpnext.PointOfSale.ItemCart = class {
} else {
return `
-
@@ -666,7 +675,7 @@ erpnext.PointOfSale.ItemCart = class {
}
}
item_data.description = frappe.ellipsis(item_data.description, 45);
- return `
+ src="${frappe.utils.escape_html(image)}" alt="${frappe.utils.escape_html(frappe.get_abbr(item_name))}">
`;
} else {
- return `
${item_data.qty || 0} ${item_data.uom}
+ ${item_data.qty || 0} ${frappe.utils.escape_html(item_data.uom)}
${format_currency(item_data.rate, currency)}
${item_data.description}
`;
+ return `${frappe.utils.escape_html(item_data.description)}
`;
}
return ``;
}
@@ -678,22 +687,26 @@ erpnext.PointOfSale.ItemCart = class {
${frappe.get_abbr(item_name)}
`;
+ return `${frappe.utils.escape_html(
+ frappe.get_abbr(item_name)
+ )}
`;
}
}
}
handle_broken_image($img) {
const item_abbr = $($img).attr("alt");
- $($img).parent().replaceWith(`${item_abbr}
`);
+ $($img)
+ .parent()
+ .replaceWith(`${frappe.utils.escape_html(item_abbr)}
`);
}
update_selector_value_in_cart_item(selector, value, item) {
const $item_to_update = this.get_cart_item(item);
- $item_to_update.attr(`data-${selector}`, escape(value));
+ $item_to_update.attr(`data-${selector}`, value);
}
toggle_checkout_btn(show_checkout) {
@@ -892,8 +905,8 @@ erpnext.PointOfSale.ItemCart = class {
${this.get_customer_image()}
-
${customer_name}
- ${customer}
+ ${frappe.utils.escape_html(customer_name)}
+ ${frappe.utils.escape_html(customer)}
@@ -980,6 +993,7 @@ erpnext.PointOfSale.ItemCart = class {
customer: current_customer,
value: this.value,
},
+ freeze: true,
callback: (r) => {
if (!r.exc) {
me.customer_info[this.df.fieldname] = this.value;
@@ -1029,9 +1043,11 @@ erpnext.PointOfSale.ItemCart = class {
};
transaction_container.append(
- `
+ `
`
);
} else {
- this.$item_image.html(`
`;
} else {
return `
-
${invoice.name}
+ ${frappe.utils.escape_html(invoice.name)}
${posting_datetime}
@@ -1039,7 +1055,7 @@ erpnext.PointOfSale.ItemCart = class {
${format_currency(invoice.grand_total, invoice.currency, frappe.sys_defaults.currency_precision) || 0}
-
+
${__(invoice.status)}
diff --git a/erpnext/selling/page/point_of_sale/pos_item_details.js b/erpnext/selling/page/point_of_sale/pos_item_details.js
index 7dc780dad7e..3a518be8574 100644
--- a/erpnext/selling/page/point_of_sale/pos_item_details.js
+++ b/erpnext/selling/page/point_of_sale/pos_item_details.js
@@ -128,25 +128,27 @@ erpnext.PointOfSale.ItemDetails = class {
return ``;
}
- this.$item_name.html(item_name);
+ this.$item_name.html(frappe.utils.escape_html(item_name));
this.$item_description.html(get_description_html());
this.$item_price.html(format_currency(price_list_rate, this.currency));
if (!this.hide_images && image) {
this.$item_image.html(
`${frappe.get_abbr(item_name)}
`);
+ this.$item_image.html(
+ `${frappe.utils.escape_html(frappe.get_abbr(item_name))}
`
+ );
}
}
handle_broken_image($img) {
const item_abbr = $($img).attr("alt");
- $($img).replaceWith(`${item_abbr}
`);
+ $($img).replaceWith(`${frappe.utils.escape_html(item_abbr)}
`);
}
render_discount_dom(item) {
diff --git a/erpnext/selling/page/point_of_sale/pos_item_selector.js b/erpnext/selling/page/point_of_sale/pos_item_selector.js
index e930322a2c4..f6530458b07 100644
--- a/erpnext/selling/page/point_of_sale/pos_item_selector.js
+++ b/erpnext/selling/page/point_of_sale/pos_item_selector.js
@@ -107,39 +107,45 @@ erpnext.PointOfSale.ItemSelector = class {
${qty_to_display}
- ${frappe.get_abbr(item.item_name)}
`;
+ ${frappe.utils.escape_html(frappe.get_abbr(item.item_name))}
`;
}
}
return `
+ data-item-code="${frappe.utils.escape_html(item.item_code)}" data-serial-no="${frappe.utils.escape_html(
+ serial_no
+ )}"
+ data-batch-no="${frappe.utils.escape_html(batch_no)}" data-uom="${frappe.utils.escape_html(uom)}"
+ data-rate="${frappe.utils.escape_html(price_list_rate || 0)}"
+ data-stock-uom="${frappe.utils.escape_html(item.stock_uom)}"
+ title="${frappe.utils.escape_html(item.item_name)}">
${get_item_image_html()}
`;
}
handle_broken_image($img) {
const item_abbr = $($img).attr("alt");
- $($img).parent().replaceWith(`
- ${frappe.ellipsis(item.item_name, 18)}
+ ${frappe.utils.escape_html(frappe.ellipsis(item.item_name, 18))}
- ${format_currency(price_list_rate, item.currency, precision) || 0} / ${uom}
+ ${
+ format_currency(price_list_rate, item.currency, precision) || 0
+ } / ${frappe.utils.escape_html(uom)}
${item_abbr}
`);
+ $($img)
+ .parent()
+ .replaceWith(`${frappe.utils.escape_html(item_abbr)}
`);
}
make_search_bar() {
@@ -252,14 +258,13 @@ erpnext.PointOfSale.ItemSelector = class {
this.$component.on("click", ".item-wrapper", function () {
const $item = $(this);
- const item_code = unescape($item.attr("data-item-code"));
- let batch_no = unescape($item.attr("data-batch-no"));
- let serial_no = unescape($item.attr("data-serial-no"));
- let uom = unescape($item.attr("data-uom"));
- let rate = unescape($item.attr("data-rate"));
- let stock_uom = unescape($item.attr("data-stock-uom"));
+ const item_code = $item.attr("data-item-code");
+ let batch_no = $item.attr("data-batch-no");
+ let serial_no = $item.attr("data-serial-no");
+ let uom = $item.attr("data-uom");
+ let rate = $item.attr("data-rate");
+ let stock_uom = $item.attr("data-stock-uom");
- // escape(undefined) returns "undefined" then unescape returns "undefined"
batch_no = batch_no === "undefined" ? undefined : batch_no;
serial_no = serial_no === "undefined" ? undefined : serial_no;
uom = uom === "undefined" ? undefined : uom;
diff --git a/erpnext/selling/page/point_of_sale/pos_past_order_list.js b/erpnext/selling/page/point_of_sale/pos_past_order_list.js
index 5ea58a43c09..1e606da46c3 100644
--- a/erpnext/selling/page/point_of_sale/pos_past_order_list.js
+++ b/erpnext/selling/page/point_of_sale/pos_past_order_list.js
@@ -38,7 +38,7 @@ erpnext.PointOfSale.PastOrderList = class {
});
const me = this;
this.$invoices_container.on("click", ".invoice-wrapper", function () {
- const invoice_name = unescape($(this).attr("data-invoice-name"));
+ const invoice_name = $(this).attr("data-invoice-name");
me.events.open_invoice_data(invoice_name);
});
@@ -99,14 +99,14 @@ erpnext.PointOfSale.PastOrderList = class {
const posting_datetime = frappe.datetime.str_to_user(
invoice.posting_date + " " + invoice.posting_time
);
- return `
+ return `
-
${invoice.name}
+ ${frappe.utils.escape_html(invoice.name)}
- ${frappe.ellipsis(invoice.customer_name, 20)}
+ ${frappe.utils.escape_html(frappe.ellipsis(invoice.customer_name, 20))}
diff --git a/erpnext/selling/page/point_of_sale/pos_past_order_summary.js b/erpnext/selling/page/point_of_sale/pos_past_order_summary.js
index 0a965c47f48..515669cdfc5 100644
--- a/erpnext/selling/page/point_of_sale/pos_past_order_summary.js
+++ b/erpnext/selling/page/point_of_sale/pos_past_order_summary.js
@@ -81,23 +81,27 @@ erpnext.PointOfSale.PastOrderSummary = class {
return `
`;
}
get_item_html(doc, item_data) {
return `
-
- ${doc.customer_name}
- ${is_customer_naming_by_customer_name ? `${doc.customer}
` : ""}
- ${this.customer_email}
+ ${frappe.utils.escape_html(doc.customer_name)}
+ ${
+ is_customer_naming_by_customer_name
+ ? `${frappe.utils.escape_html(doc.customer)}
`
+ : ""
+ }
+ ${frappe.utils.escape_html(this.customer_email)}
${__("Sold by")}: ${doc.owner}
+ ${__("Sold by")}: ${frappe.utils.escape_html(doc.owner)}
${format_currency(doc.paid_amount, doc.currency)}
- ${doc.name}
+ ${frappe.utils.escape_html(doc.name)}
${__(doc.status)}
-
`;
@@ -139,10 +143,10 @@ erpnext.PointOfSale.PastOrderSummary = class {
.map((t) => {
// if tax rate is 0, don't print it.
const description = /[0-9]+/.test(t.description)
- ? t.description
+ ? frappe.utils.escape_html(t.description)
: t.rate != 0
- ? `${t.description} @ ${t.rate}%`
- : t.description;
+ ? `${frappe.utils.escape_html(t.description)} @ ${t.rate}%`
+ : frappe.utils.escape_html(t.description);
return `
${item_data.item_name}
- ${item_data.qty || 0} ${item_data.uom}
+ ${frappe.utils.escape_html(item_data.item_name)}
+ ${item_data.qty || 0} ${frappe.utils.escape_html(item_data.uom)}
${get_rate_discount_html()}
${description}
diff --git a/erpnext/selling/page/point_of_sale/pos_payment.js b/erpnext/selling/page/point_of_sale/pos_payment.js
index 165066a151a..7d995ac131c 100644
--- a/erpnext/selling/page/point_of_sale/pos_payment.js
+++ b/erpnext/selling/page/point_of_sale/pos_payment.js
@@ -408,8 +408,10 @@ erpnext.PointOfSale.Payment = class {
return `
-
- ${p.mode_of_payment}
+
`
diff --git a/erpnext/selling/report/sales_analytics/sales_analytics.py b/erpnext/selling/report/sales_analytics/sales_analytics.py
index d4f7ad42b43..5786adc6881 100644
--- a/erpnext/selling/report/sales_analytics/sales_analytics.py
+++ b/erpnext/selling/report/sales_analytics/sales_analytics.py
@@ -138,12 +138,30 @@ class Analytics:
self.get_sales_transactions_based_on_project()
self.get_rows()
+ def _get_permitted_parent_names(self):
+ return frappe.get_list(
+ self.filters.doc_type,
+ fields=["name"],
+ filters={
+ "docstatus": 1,
+ "company": ["in", self.filters.company],
+ self.date_field: ("between", [self.filters.from_date, self.filters.to_date]),
+ },
+ pluck="name",
+ )
+
def get_sales_transactions_based_on_order_type(self):
if self.filters["value_quantity"] == "Value":
value_field = "base_net_total"
else:
value_field = "total_qty"
+ permitted_names = self._get_permitted_parent_names()
+ if not permitted_names:
+ self.entries = []
+ self.get_teams()
+ return
+
doctype = DocType(self.filters.doc_type)
self.entries = (
@@ -153,12 +171,7 @@ class Analytics:
doctype[self.date_field],
doctype[value_field].as_("value_field"),
)
- .where(
- (doctype.docstatus == 1)
- & (doctype.company.isin(self.filters.company))
- & (doctype[self.date_field].between(self.filters.from_date, self.filters.to_date))
- & (IfNull(doctype.order_type, "") != "")
- )
+ .where((doctype.name.isin(permitted_names)) & (IfNull(doctype.order_type, "") != ""))
.orderby(doctype.order_type)
).run(as_dict=True)
@@ -186,8 +199,10 @@ class Analytics:
if self.filters.doc_type in ["Sales Invoice", "Purchase Invoice", "Payment Entry"]:
filters.update({"is_opening": "No"})
- self.entries = frappe.get_all(
- self.filters.doc_type, fields=[entity, entity_name, value_field, self.date_field], filters=filters
+ self.entries = frappe.get_list(
+ self.filters.doc_type,
+ fields=[entity, entity_name, value_field, self.date_field],
+ filters=filters,
)
self.entity_names = {}
@@ -200,6 +215,12 @@ class Analytics:
else:
value_field = "stock_qty"
+ permitted_names = self._get_permitted_parent_names()
+ if not permitted_names:
+ self.entries = []
+ self.entity_names = {}
+ return
+
doctype = DocType(self.filters.doc_type)
doctype_item = DocType(f"{self.filters.doc_type} Item")
@@ -214,11 +235,7 @@ class Analytics:
doctype_item[value_field].as_("value_field"),
doctype[self.date_field],
)
- .where(
- (doctype_item.docstatus == 1)
- & (doctype.company.isin(self.filters.company))
- & (doctype[self.date_field].between(self.filters.from_date, self.filters.to_date))
- )
+ .where((doctype_item.docstatus == 1) & (doctype.name.isin(permitted_names)))
).run(as_dict=True)
self.entity_names = {}
@@ -248,7 +265,7 @@ class Analytics:
if self.filters.doc_type in ["Sales Invoice", "Purchase Invoice", "Payment Entry"]:
filters.update({"is_opening": "No"})
- self.entries = frappe.get_all(
+ self.entries = frappe.get_list(
self.filters.doc_type,
fields=[entity_field, value_field, self.date_field],
filters=filters,
@@ -261,6 +278,12 @@ class Analytics:
else:
value_field = "qty"
+ permitted_names = self._get_permitted_parent_names()
+ if not permitted_names:
+ self.entries = []
+ self.get_groups()
+ return
+
doctype = DocType(self.filters.doc_type)
doctype_item = DocType(f"{self.filters.doc_type} Item")
@@ -273,11 +296,7 @@ class Analytics:
doctype_item[value_field].as_("value_field"),
doctype[self.date_field],
)
- .where(
- (doctype_item.docstatus == 1)
- & (doctype.company.isin(self.filters.company))
- & (doctype[self.date_field].between(self.filters.from_date, self.filters.to_date))
- )
+ .where((doctype_item.docstatus == 1) & (doctype.name.isin(permitted_names)))
).run(as_dict=True)
self.get_groups()
@@ -300,8 +319,10 @@ class Analytics:
if self.filters.doc_type in ["Sales Invoice", "Purchase Invoice", "Payment Entry"]:
filters.update({"is_opening": "No"})
- self.entries = frappe.get_all(
- self.filters.doc_type, fields=[entity, value_field, self.date_field], filters=filters
+ self.entries = frappe.get_list(
+ self.filters.doc_type,
+ fields=[entity, value_field, self.date_field],
+ filters=filters,
)
def get_rows(self):
diff --git a/erpnext/setup/setup_wizard/data/country_wise_tax.json b/erpnext/setup/setup_wizard/data/country_wise_tax.json
index 3259a2323b7..18c513b3c2b 100644
--- a/erpnext/setup/setup_wizard/data/country_wise_tax.json
+++ b/erpnext/setup/setup_wizard/data/country_wise_tax.json
@@ -4115,9 +4115,14 @@
},
"Japan": {
- "Japan Tax": {
- "account_name": "CT",
- "tax_rate": 5.00
+ "Japan Tax 10%": {
+ "account_name": "CT 10%",
+ "tax_rate": 10.00,
+ "default": 1
+ },
+ "Japan Tax 8%": {
+ "account_name": "CT 8%",
+ "tax_rate": 8.00
}
},
diff --git a/erpnext/stock/doctype/bin/bin.py b/erpnext/stock/doctype/bin/bin.py
index 79e9776b91c..2af1f645494 100644
--- a/erpnext/stock/doctype/bin/bin.py
+++ b/erpnext/stock/doctype/bin/bin.py
@@ -263,8 +263,9 @@ def update_qty(bin_name, args):
# actual qty is already updated by processing current voucher
actual_qty = bin_details.actual_qty or 0.0
- # actual qty is not up to date in case of backdated transaction
- if future_sle_exists(args):
+ # actual qty is not up to date in case of backdated transactions
+ # or when cancellations are the most recent SLE
+ if future_sle_exists(args) or args.get("is_cancelled"):
actual_qty = get_actual_qty(args.get("item_code"), args.get("warehouse"))
ordered_qty = flt(bin_details.ordered_qty) + flt(args.get("ordered_qty"))
diff --git a/erpnext/stock/doctype/serial_and_batch_bundle/serial_and_batch_bundle.py b/erpnext/stock/doctype/serial_and_batch_bundle/serial_and_batch_bundle.py
index 8cf96a149d7..1ac6afd15b1 100644
--- a/erpnext/stock/doctype/serial_and_batch_bundle/serial_and_batch_bundle.py
+++ b/erpnext/stock/doctype/serial_and_batch_bundle/serial_and_batch_bundle.py
@@ -2194,25 +2194,6 @@ def update_serial_batch_no_ledgers(bundle, entries, child_row, parent_doc, wareh
return doc
-@frappe.whitelist()
-def update_serial_or_batch(bundle_id, serial_no=None, batch_no=None):
- if batch_no and not serial_no:
- if qty := frappe.db.get_value(
- "Serial and Batch Entry", {"parent": bundle_id, "batch_no": batch_no}, "qty"
- ):
- frappe.db.set_value(
- "Serial and Batch Entry", {"parent": bundle_id, "batch_no": batch_no}, "qty", qty + 1
- )
- return
-
- doc = frappe.get_cached_doc("Serial and Batch Bundle", bundle_id)
- if not serial_no and not batch_no:
- return
-
- doc.append("entries", {"serial_no": serial_no, "batch_no": batch_no, "qty": 1})
- doc.save(ignore_permissions=True)
-
-
def get_serial_and_batch_ledger(**kwargs):
kwargs = frappe._dict(kwargs)
diff --git a/erpnext/stock/doctype/stock_ledger_entry/stock_ledger_entry.json b/erpnext/stock/doctype/stock_ledger_entry/stock_ledger_entry.json
index 3af946aa8f3..bfb4ec368dd 100644
--- a/erpnext/stock/doctype/stock_ledger_entry/stock_ledger_entry.json
+++ b/erpnext/stock/doctype/stock_ledger_entry/stock_ledger_entry.json
@@ -1,5 +1,6 @@
{
"actions": [],
+ "allow_bulk_edit": 1,
"allow_copy": 1,
"autoname": "MAT-SLE-.YYYY.-.#####",
"creation": "2013-01-29 19:25:42",
@@ -204,7 +205,7 @@
{
"fieldname": "valuation_rate",
"fieldtype": "Currency",
- "label": "Valuation Rate",
+ "label": "Average Rate",
"oldfieldname": "valuation_rate",
"oldfieldtype": "Currency",
"options": "Company:company:default_currency",
@@ -362,11 +363,11 @@
"in_create": 1,
"index_web_pages_for_search": 1,
"links": [],
- "modified": "2025-10-04 09:59:15.546556",
+ "modified": "2026-05-26 19:07:43.537450",
"modified_by": "Administrator",
"module": "Stock",
"name": "Stock Ledger Entry",
- "naming_rule": "Expression (old style)",
+ "naming_rule": "Expression",
"owner": "Administrator",
"permissions": [
{
diff --git a/erpnext/stock/report/stock_ledger/stock_ledger.py b/erpnext/stock/report/stock_ledger/stock_ledger.py
index 3f59dc6be3b..2152fce31c0 100644
--- a/erpnext/stock/report/stock_ledger/stock_ledger.py
+++ b/erpnext/stock/report/stock_ledger/stock_ledger.py
@@ -109,10 +109,11 @@ def execute(filters=None):
if sle.serial_no:
update_available_serial_nos(available_serial_nos, sle)
- if sle.actual_qty:
+ if sle.actual_qty < 0:
sle["in_out_rate"] = flt(sle.stock_value_difference / sle.actual_qty, precision)
+ sle["incoming_rate"] = 0
- elif sle.voucher_type == "Stock Reconciliation":
+ elif sle.voucher_type == "Stock Reconciliation" and sle.actual_qty < 0:
sle["in_out_rate"] = sle.valuation_rate
if (
@@ -193,7 +194,7 @@ def get_segregated_bundle_entries(sle, bundle_details, batch_balance_dict, filte
new_sle.update(row)
new_sle.update(
{
- "in_out_rate": flt(new_sle.stock_value_difference / row.qty) if row.qty else 0,
+ "in_out_rate": flt(new_sle.stock_value_difference / row.qty) if row.qty < 0 else 0,
"in_qty": row.qty if row.qty > 0 else 0,
"out_qty": row.qty if row.qty < 0 else 0,
"qty_after_transaction": qty_before_transaction + row.qty,
@@ -375,7 +376,7 @@ def get_columns(filters):
"convertible": "rate",
},
{
- "label": _("Valuation Rate"),
+ "label": _("Outgoing Rate"),
"fieldname": "in_out_rate",
"fieldtype": filters.valuation_field_type,
"width": 140,
diff --git a/erpnext/stock/stock_ledger.py b/erpnext/stock/stock_ledger.py
index a50bc4f8325..a1dc9d13a4e 100644
--- a/erpnext/stock/stock_ledger.py
+++ b/erpnext/stock/stock_ledger.py
@@ -887,7 +887,7 @@ class update_entries_after:
# Only run in reposting
self.get_serialized_values(sle)
self.wh_data.qty_after_transaction += flt(sle.actual_qty)
- if sle.voucher_type == "Stock Reconciliation" and not sle.batch_no:
+ if sle.voucher_type == "Stock Reconciliation" and not sle.batch_no and has_correct_data(sle):
self.wh_data.qty_after_transaction = sle.qty_after_transaction
self.wh_data.stock_value = flt(self.wh_data.qty_after_transaction) * flt(
@@ -2517,3 +2517,28 @@ def get_incoming_rate_for_serial_and_batch(item_code, row, sn_obj):
@frappe.request_cache
def is_repack_entry(stock_entry_id):
return frappe.get_cached_value("Stock Entry", stock_entry_id, "purpose") == "Repack"
+
+
+def has_correct_data(sle):
+ previous_sle = get_previous_sle(
+ {
+ "item_code": sle.item_code,
+ "warehouse": sle.warehouse,
+ "posting_date": sle.posting_date,
+ "posting_time": sle.posting_time,
+ "creation": sle.creation,
+ "sle": sle.name,
+ }
+ )
+
+ if not previous_sle:
+ return True
+
+ previous_qty = previous_sle.get("qty_after_transaction") or 0
+ if previous_qty and not frappe.db.get_value(
+ "Stock Ledger Entry",
+ {"voucher_detail_no": sle.voucher_detail_no, "is_cancelled": 0, "actual_qty": ("<", 0)},
+ ):
+ return False
+
+ return True
diff --git a/erpnext/support/doctype/issue/issue.py b/erpnext/support/doctype/issue/issue.py
index 70ced430257..faa12bd5419 100644
--- a/erpnext/support/doctype/issue/issue.py
+++ b/erpnext/support/doctype/issue/issue.py
@@ -218,11 +218,13 @@ def get_issue_list(doctype, txt, filters, limit_start, limit_page_length=20, ord
@frappe.whitelist()
def set_multiple_status(names, status):
for name in json.loads(names):
- frappe.db.set_value("Issue", name, "status", status)
+ set_status(name, status)
@frappe.whitelist()
def set_status(name, status):
+ frappe.has_permission("Issue", "write", name, throw=True)
+
frappe.db.set_value("Issue", name, "status", status)
diff --git a/erpnext/templates/pages/task_info.html b/erpnext/templates/pages/task_info.html
index fe4d304a398..4a98b425e73 100644
--- a/erpnext/templates/pages/task_info.html
+++ b/erpnext/templates/pages/task_info.html
@@ -1,11 +1,11 @@
{% extends "templates/web.html" %}
-{% block title %} {{ doc.name }} {% endblock %}
+{% block title %} {{ doc.name|e }} {% endblock %}
{% block breadcrumbs %}
-
+ ${frappe.utils.escape_html(p.mode_of_payment)}
@@ -544,7 +546,7 @@ erpnext.PointOfSale.Payment = class {
${amount}
Redeem Loyalty Points
${amount}
- ${loyalty_program}
+ ${frappe.utils.escape_html(loyalty_program)}
{{ __("Comments") }}
+{{ _("Comments") }}
{{comment.sender_full_name}}: - {{comment.subject}} {{ __("on") }} {{comment.creation.strftime('%Y-%m-%d')}}
+{{comment.comment_email}}: + {{comment.content|e}} {{ _("on") }} {{comment.creation.strftime('%Y-%m-%d')}}
{% endfor %}{{ __("Add Comment") }}
- -