diff --git a/erpnext/support/doctype/issue/issue.py b/erpnext/support/doctype/issue/issue.py index c35b76cf37d..a08c9b22c23 100644 --- a/erpnext/support/doctype/issue/issue.py +++ b/erpnext/support/doctype/issue/issue.py @@ -226,7 +226,6 @@ def set_multiple_status(names, status): @frappe.whitelist() def set_status(name, status): frappe.has_permission("Issue", "write", name, throw=True) - frappe.db.set_value("Issue", name, "status", status) diff --git a/erpnext/support/doctype/issue/test_issue.py b/erpnext/support/doctype/issue/test_issue.py index acb3869ce6b..1312ebd42a7 100644 --- a/erpnext/support/doctype/issue/test_issue.py +++ b/erpnext/support/doctype/issue/test_issue.py @@ -525,6 +525,38 @@ class TestFirstResponseTime(TestSetUp): ) self.assertEqual(issue.first_response_time, 1.0) + def _get_no_perm_user(self): + email = "test_no_issue_perm@example.com" + if not frappe.db.exists("User", email): + user = frappe.new_doc("User") + user.email = email + user.first_name = "No Perm" + user.send_welcome_email = 0 + user.insert(ignore_permissions=True) + return email + + def test_set_status_requires_write_permission(self): + from erpnext.support.doctype.issue.issue import set_status + + issue = frappe.new_doc("Issue") + issue.subject = "_Test Permission Issue" + issue.insert(ignore_permissions=True) + frappe.set_user(self._get_no_perm_user()) + self.assertRaises(frappe.PermissionError, set_status, issue.name, "Closed") + frappe.set_user("Administrator") + + def test_set_multiple_status_requires_write_permission(self): + import json + + from erpnext.support.doctype.issue.issue import set_multiple_status + + issue = frappe.new_doc("Issue") + issue.subject = "_Test Permission Issue" + issue.insert(ignore_permissions=True) + frappe.set_user(self._get_no_perm_user()) + self.assertRaises(frappe.PermissionError, set_multiple_status, json.dumps([issue.name]), "Closed") + frappe.set_user("Administrator") + def create_issue_and_communication(issue_creation, first_responded_on): issue = make_issue(issue_creation, index=1)