nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-09-02 08:03:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(accounts): add permission checks on payment entry whitelisted methods (#58644)

Browse Source
This commit is contained in:
Diptanil Saha
2026-09-01 14:54:40 +05:30
committed by GitHub
parent fb74a030de
commit c745558168
4 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
erpnext/accounts/doctype/dunning/dunning.js
View File

@@ -234,8 +234,10 @@ frappe.ui.form.on("Dunning", {
dn: frm.doc.name,
},
callback: function (r) {
var doc = frappe.model.sync(r.message);
frappe.set_route("Form", doc[0].doctype, doc[0].name);
if (!r.exc) {
var doc = frappe.model.sync(r.message);
frappe.set_route("Form", doc[0].doctype, doc[0].name);
}
},
});
},

5
erpnext/accounts/doctype/journal_entry/journal_entry.py
View File

@@ -1402,6 +1402,7 @@ def get_payment_entry_against_order(
dt, dn, amount=None, debit_in_account_currency=None, journal_entry=False, bank_account=None
):
ref_doc = frappe.get_doc(dt, dn)
ref_doc.check_permission()
if flt(ref_doc.per_billed, 2) > 0:
frappe.throw(_("Can only make payment against unbilled {0}").format(dt))
@@ -1447,6 +1448,8 @@ def get_payment_entry_against_invoice(
dt, dn, amount=None, debit_in_account_currency=None, journal_entry=False, bank_account=None
):
ref_doc = frappe.get_doc(dt, dn)
ref_doc.check_permission()
if dt == "Sales Invoice":
party_type = "Customer"
party_account = get_party_account_based_on_invoice_discounting(dn) or ref_doc.debit_to
@@ -1482,6 +1485,8 @@ def get_payment_entry_against_invoice(
def get_payment_entry(ref_doc, args):
frappe.has_permission("Journal Entry", ptype="create", throw=True)
cost_center = ref_doc.get("cost_center") or frappe.get_cached_value(
"Company", ref_doc.company, "cost_center"
)

4
erpnext/accounts/doctype/payment_entry/payment_entry.py
View File

@@ -2893,7 +2893,11 @@ def get_payment_entry(
reference_date=None,
created_from_payment_request=False,
):
frappe.has_permission("Payment Entry", ptype="create", throw=True)
doc = frappe.get_doc(dt, dn)
doc.check_permission()
over_billing_allowance = frappe.get_single_value("Accounts Settings", "over_billing_allowance")
if dt in ("Sales Order", "Purchase Order") and flt(doc.per_billed, 2) >= (100.0 + over_billing_allowance):
frappe.throw(_("Can only make payment against unbilled {0}").format(_(dt)))

6
erpnext/public/js/controllers/transaction.js
View File

@@ -2804,8 +2804,10 @@ erpnext.TransactionController = class TransactionController extends erpnext.taxe
method: me.get_method_for_payment(),
args: args,
callback: function (r) {
var doclist = frappe.model.sync(r.message);
frappe.set_route("Form", doclist[0].doctype, doclist[0].name);
if (!r.exc) {
var doclist = frappe.model.sync(r.message);
frappe.set_route("Form", doclist[0].doctype, doclist[0].name);
}
},
});
}