From a9f3d69fbe48c206c042a1bce48ceae7852dcb0d Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Fri, 11 Sep 2026 04:30:00 +0000
Subject: [PATCH] fix(accounts): add permission checks on
 `invoice_discounting.get_invoices` (backport #58975) (#58990)

Co-authored-by: Diptanil Saha <diptanil@frappe.io>
---
 .../invoice_discounting/invoice_discounting.js      |  1 +
 .../invoice_discounting/invoice_discounting.json    |  8 +++++---
 .../invoice_discounting/invoice_discounting.py      | 13 +++++++++----
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js b/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js
index 1e73c669d84..6e533168602 100644
--- a/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js
+++ b/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js
@@ -136,6 +136,7 @@ frappe.ui.form.on("Invoice Discounting", {
 			],
 			primary_action: function () {
 				var data = d.get_values();
+				data.company = frm.doc.company;
 
 				frappe.call({
 					method: "erpnext.accounts.doctype.invoice_discounting.invoice_discounting.get_invoices",
diff --git a/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json b/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json
index bc389465c4d..39755d84e5c 100644
--- a/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json
+++ b/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json
@@ -1,5 +1,6 @@
 {
  "actions": [],
+ "allow_bulk_edit": 1,
  "allow_import": 1,
  "autoname": "ACC-INV-DISC-.YYYY.-.#####",
  "creation": "2019-03-07 12:01:56.296952",
@@ -170,7 +171,7 @@
  ],
  "is_submittable": 1,
  "links": [],
- "modified": "2024-03-27 13:09:52.746196",
+ "modified": "2026-09-09 17:04:59.512294",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Invoice Discounting",
@@ -187,14 +188,15 @@
    "print": 1,
    "read": 1,
    "report": 1,
-   "role": "System Manager",
+   "role": "Accounts Manager",
    "share": 1,
    "submit": 1,
    "write": 1
   }
  ],
+ "row_format": "Dynamic",
  "sort_field": "creation",
  "sort_order": "DESC",
  "states": [],
  "track_changes": 1
-}
\ No newline at end of file
+}
diff --git a/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py b/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py
index 5d3c2b987ba..6b5fd389ae3 100644
--- a/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py
+++ b/erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py
@@ -2,8 +2,6 @@
 # For license information, please see license.txt
 
 
-import json
-
 import frappe
 from frappe import _
 from frappe.utils import add_days, flt, getdate, nowdate
@@ -317,8 +315,15 @@ class InvoiceDiscounting(AccountsController):
 
 
 @frappe.whitelist()
-def get_invoices(filters):
-	filters = frappe._dict(json.loads(filters))
+def get_invoices(filters: str | dict):
+	filters = frappe._dict(frappe.parse_json(filters))
+
+	if not filters.get("company"):
+		frappe.throw(_("Please set company on the Document before requesting for invoices."))
+
+	frappe.has_permission("Company", doc=filters.get("company"), throw=True)
+	frappe.has_permission("Invoice Discounting", throw=True)
+
 	cond = []
 	if filters.customer:
 		cond.append("customer=%(customer)s")