From caf8a36bdb34d8eb754bc8d717916ce6795a785e Mon Sep 17 00:00:00 2001 From: Diptanil Saha Date: Sat, 29 Aug 2026 18:06:25 +0530 Subject: [PATCH] fix(accounts): added permission checks on multiple payment entry whitelisted methods (#58555) --- erpnext/accounts/doctype/dunning/dunning.js | 6 ++++-- erpnext/accounts/doctype/journal_entry/mapper.py | 5 +++++ erpnext/accounts/doctype/payment_entry/payment_entry.py | 4 ++++ erpnext/public/js/controllers/transaction.js | 6 ++++-- 4 files changed, 17 insertions(+), 4 deletions(-) diff --git a/erpnext/accounts/doctype/dunning/dunning.js b/erpnext/accounts/doctype/dunning/dunning.js index 69458652761..2c0c069dfa8 100644 --- a/erpnext/accounts/doctype/dunning/dunning.js +++ b/erpnext/accounts/doctype/dunning/dunning.js @@ -234,8 +234,10 @@ frappe.ui.form.on("Dunning", { dn: frm.doc.name, }, callback: function (r) { - var doc = frappe.model.sync(r.message); - frappe.set_route("Form", doc[0].doctype, doc[0].name); + if (!r.exc) { + var doc = frappe.model.sync(r.message); + frappe.set_route("Form", doc[0].doctype, doc[0].name); + } }, }); }, diff --git a/erpnext/accounts/doctype/journal_entry/mapper.py b/erpnext/accounts/doctype/journal_entry/mapper.py index 715eecbd398..ac0c271d09a 100644 --- a/erpnext/accounts/doctype/journal_entry/mapper.py +++ b/erpnext/accounts/doctype/journal_entry/mapper.py @@ -27,6 +27,7 @@ def get_payment_entry_against_order( ) -> dict | Document: """Build an advance-payment Journal Entry against an unbilled Sales/Purchase Order.""" ref_doc = frappe.get_doc(dt, dn) + ref_doc.check_permission() if flt(ref_doc.per_billed, 2) > 0: frappe.throw(_("Can only make payment against unbilled {0}").format(dt)) @@ -78,6 +79,8 @@ def get_payment_entry_against_invoice( ) -> dict | Document: """Build a payment Journal Entry against a Sales/Purchase Invoice's outstanding amount.""" ref_doc = frappe.get_doc(dt, dn) + ref_doc.check_permission() + if dt == "Sales Invoice": party_type = "Customer" party_account = get_party_account_based_on_invoice_discounting(dn) or ref_doc.debit_to @@ -118,6 +121,8 @@ def get_payment_entry(ref_doc, args: dict) -> dict | Document: Returns the Journal Entry document when `args["journal_entry"]` is truthy, otherwise its dict (for client calls). """ + frappe.has_permission("Journal Entry", ptype="create", throw=True) + je = frappe.new_doc("Journal Entry") je.update({"voucher_type": "Bank Entry", "company": ref_doc.company, "remark": args.get("remarks")}) diff --git a/erpnext/accounts/doctype/payment_entry/payment_entry.py b/erpnext/accounts/doctype/payment_entry/payment_entry.py index 010b229e762..9c3f5583607 100644 --- a/erpnext/accounts/doctype/payment_entry/payment_entry.py +++ b/erpnext/accounts/doctype/payment_entry/payment_entry.py @@ -2626,7 +2626,11 @@ def get_payment_entry( reference_date: str | date | None = None, created_from_payment_request: bool | None = None, ): + frappe.has_permission("Payment Entry", ptype="create", throw=True) + doc = frappe.get_doc(dt, dn) + doc.check_permission() + over_billing_allowance = frappe.get_single_value("Accounts Settings", "over_billing_allowance") if dt in ("Sales Order", "Purchase Order") and flt(doc.per_billed, 2) >= (100.0 + over_billing_allowance): frappe.throw(_("Can only make payment against unbilled {0}").format(_(dt))) diff --git a/erpnext/public/js/controllers/transaction.js b/erpnext/public/js/controllers/transaction.js index 76ddb17fb61..b7a5fd9b2b7 100644 --- a/erpnext/public/js/controllers/transaction.js +++ b/erpnext/public/js/controllers/transaction.js @@ -2888,8 +2888,10 @@ erpnext.TransactionController = class TransactionController extends erpnext.taxe method: me.get_method_for_payment(), args: args, callback: function (r) { - var doclist = frappe.model.sync(r.message); - frappe.set_route("Form", doclist[0].doctype, doclist[0].name); + if (!r.exc) { + var doclist = frappe.model.sync(r.message); + frappe.set_route("Form", doclist[0].doctype, doclist[0].name); + } }, }); }