mirror of
https://github.com/frappe/erpnext.git
synced 2026-08-13 14:41:53 +00:00
fix(FTA Audit File): block regeneration from Generated state
The JS button only renders the Generate/Retry action for Draft and Error; the REST endpoint, however, still let an authenticated caller silently overwrite the attached CSV on a Generated FAF. Tighten the server-side guard to match the UI lifecycle so the destructive action has to be explicit (delete and create a new doc to regenerate).
This commit is contained in:
@@ -121,8 +121,11 @@ class FTAAuditFile(Document):
|
||||
current_status = frappe.db.get_value(self.doctype, self.name, "status", for_update=True)
|
||||
if current_status in IN_FLIGHT_STATUSES:
|
||||
frappe.throw(_("FAF generation is already {0} for this document.").format(current_status))
|
||||
if current_status == "Submitted":
|
||||
frappe.throw(_("Cannot regenerate a Submitted FAF."))
|
||||
if current_status in ("Generated", "Submitted"):
|
||||
# UI hides the Generate/Retry button for Generated and Submitted;
|
||||
# enforce the same lifecycle on the REST endpoint so a direct
|
||||
# call cannot silently overwrite the attached CSV.
|
||||
frappe.throw(_("FAF is already {0}; create a new document to regenerate.").format(current_status))
|
||||
|
||||
self.status = "Queued"
|
||||
self.generation_log = ""
|
||||
|
||||
Reference in New Issue
Block a user