From a8ba713f8033ad0719861eaac0a00ac55d451c94 Mon Sep 17 00:00:00 2001 From: Pandiyan P Date: Thu, 27 Aug 2026 17:35:43 +0530 Subject: [PATCH] fix(selling): check sales order permission before work order creation (#58492) --- erpnext/selling/doctype/sales_order/mapper.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/erpnext/selling/doctype/sales_order/mapper.py b/erpnext/selling/doctype/sales_order/mapper.py index e73520455e6..fafeb810660 100644 --- a/erpnext/selling/doctype/sales_order/mapper.py +++ b/erpnext/selling/doctype/sales_order/mapper.py @@ -875,6 +875,8 @@ def set_delivery_date(items: list, sales_order: str) -> None: @frappe.whitelist(methods=["POST"]) def make_work_orders(items: str | dict, sales_order: str, company: str, project: str | None = None): """Make Work Orders against the given Sales Order for the given `items`""" + frappe.has_permission("Sales Order", "read", sales_order, throw=True) + items = frappe.parse_json(items).get("items") out = []