nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-09-02 16:13:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(accounts): added permission checks on multiple payment entry whitelisted methods (#58555)

Browse Source
This commit is contained in:
Diptanil Saha
2026-08-29 18:06:25 +05:30
committed by GitHub
parent a59792a605
commit caf8a36bdb
4 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
erpnext/accounts/doctype/dunning/dunning.js
View File

@@ -234,8 +234,10 @@ frappe.ui.form.on("Dunning", {
dn: frm.doc.name, dn: frm.doc.name,
}, },
callback: function (r) { callback: function (r) {
var doc = frappe.model.sync(r.message); if (!r.exc) {
frappe.set_route("Form", doc[0].doctype, doc[0].name); var doc = frappe.model.sync(r.message);
frappe.set_route("Form", doc[0].doctype, doc[0].name);
}
}, },
}); });
}, },

5
erpnext/accounts/doctype/journal_entry/mapper.py
View File

@@ -27,6 +27,7 @@ def get_payment_entry_against_order(
) -> dict | Document: ) -> dict | Document:
"""Build an advance-payment Journal Entry against an unbilled Sales/Purchase Order.""" """Build an advance-payment Journal Entry against an unbilled Sales/Purchase Order."""
ref_doc = frappe.get_doc(dt, dn) ref_doc = frappe.get_doc(dt, dn)
ref_doc.check_permission()
if flt(ref_doc.per_billed, 2) > 0: if flt(ref_doc.per_billed, 2) > 0:
frappe.throw(_("Can only make payment against unbilled {0}").format(dt)) frappe.throw(_("Can only make payment against unbilled {0}").format(dt))
@@ -78,6 +79,8 @@ def get_payment_entry_against_invoice(
) -> dict | Document: ) -> dict | Document:
"""Build a payment Journal Entry against a Sales/Purchase Invoice's outstanding amount.""" """Build a payment Journal Entry against a Sales/Purchase Invoice's outstanding amount."""
ref_doc = frappe.get_doc(dt, dn) ref_doc = frappe.get_doc(dt, dn)
ref_doc.check_permission()
if dt == "Sales Invoice": if dt == "Sales Invoice":
party_type = "Customer" party_type = "Customer"
party_account = get_party_account_based_on_invoice_discounting(dn) or ref_doc.debit_to party_account = get_party_account_based_on_invoice_discounting(dn) or ref_doc.debit_to
@@ -118,6 +121,8 @@ def get_payment_entry(ref_doc, args: dict) -> dict | Document:
Returns the Journal Entry document when `args["journal_entry"]` is truthy, otherwise its Returns the Journal Entry document when `args["journal_entry"]` is truthy, otherwise its
dict (for client calls). dict (for client calls).
""" """
frappe.has_permission("Journal Entry", ptype="create", throw=True)
je = frappe.new_doc("Journal Entry") je = frappe.new_doc("Journal Entry")
je.update({"voucher_type": "Bank Entry", "company": ref_doc.company, "remark": args.get("remarks")}) je.update({"voucher_type": "Bank Entry", "company": ref_doc.company, "remark": args.get("remarks")})

4
erpnext/accounts/doctype/payment_entry/payment_entry.py
View File

@@ -2626,7 +2626,11 @@ def get_payment_entry(
reference_date: str | date | None = None, reference_date: str | date | None = None,
created_from_payment_request: bool | None = None, created_from_payment_request: bool | None = None,
): ):
frappe.has_permission("Payment Entry", ptype="create", throw=True)
doc = frappe.get_doc(dt, dn) doc = frappe.get_doc(dt, dn)
doc.check_permission()
over_billing_allowance = frappe.get_single_value("Accounts Settings", "over_billing_allowance") over_billing_allowance = frappe.get_single_value("Accounts Settings", "over_billing_allowance")
if dt in ("Sales Order", "Purchase Order") and flt(doc.per_billed, 2) >= (100.0 + over_billing_allowance): if dt in ("Sales Order", "Purchase Order") and flt(doc.per_billed, 2) >= (100.0 + over_billing_allowance):
frappe.throw(_("Can only make payment against unbilled {0}").format(_(dt))) frappe.throw(_("Can only make payment against unbilled {0}").format(_(dt)))

6
erpnext/public/js/controllers/transaction.js
View File

@@ -2888,8 +2888,10 @@ erpnext.TransactionController = class TransactionController extends erpnext.taxe
method: me.get_method_for_payment(), method: me.get_method_for_payment(),
args: args, args: args,
callback: function (r) { callback: function (r) {
var doclist = frappe.model.sync(r.message); if (!r.exc) {
frappe.set_route("Form", doclist[0].doctype, doclist[0].name); var doclist = frappe.model.sync(r.message);
frappe.set_route("Form", doclist[0].doctype, doclist[0].name);
}
}, },
}); });
} }