Merge pull request #57201 from diptanilsaha/fix/perms_whitelisted_methods

fix: permission checks on various whitelisted methods

erpnext/accounts/doctype/payment_request/payment_request.js

@@ -37,6 +37,8 @@ frappe.ui.form.on("Payment Request", "refresh", function (frm) {
 		frm.set_intro(__("Failure: {0}", [frm.doc.failed_reason]), "red");
 	}
 
+	let sending_email = false;
+
 	if (
 		frm.doc.payment_request_type == "Inward" &&
 		frm.doc.payment_channel !== "Phone" &&
@@ -45,16 +47,16 @@ frappe.ui.form.on("Payment Request", "refresh", function (frm) {
 		frm.doc.docstatus == 1
 	) {
 		frm.add_custom_button(__("Resend Payment Email"), function () {
-			frappe.call({
-				method: "erpnext.accounts.doctype.payment_request.payment_request.resend_payment_email",
-				args: { docname: frm.doc.name },
-				freeze: true,
-				freeze_message: __("Sending"),
-				callback: function (r) {
-					if (!r.exc) {
-						frappe.msgprint(__("Message Sent"));
-					}
-				},
+			if (sending_email) {
+				frappe.show_alert({ message: __("Sending Email"), indicator: "blue" });
+				return;
+			}
+			sending_email = true;
+			frappe.show_alert({ message: __("Sending Email"), indicator: "blue" });
+			frm.call("resend_payment_email").then((r) => {
+				const msg = !r.exc ? __("Email Sent") : __("Email couldn't be sent.");
+				frappe.show_alert({ message: msg, indicator: !r.exc ? "green" : "red" });
+				sending_email = false;
 			});
 		});
 	}

erpnext/accounts/doctype/payment_request/payment_request.py

@@ -589,6 +589,18 @@ class PaymentRequest(Document):
 
 		return payment_entry
 
+	@frappe.whitelist(methods=["POST"])
+	def resend_payment_email(self):
+		if not (
+			self.docstatus == 1
+			and self.payment_request_type == "Inward"
+			and self.payment_channel != "Phone"
+			and self.status not in ["Initiated", "Paid"]
+		):
+			frappe.throw(_("Payment Link couldn't be sent."))
+
+		self.send_email()
+
 	def send_email(self):
 		"""send email with payment link"""
 		email_args = {
@@ -606,11 +618,14 @@ class PaymentRequest(Document):
 				)
 			],
 		}
+		job_id = f"send_payment_email::{self.name}"
 		enqueue(
 			method=frappe.sendmail,
 			queue="short",
 			timeout=300,
 			is_async=True,
+			job_id=job_id,
+			deduplicate=True,
 			enqueue_after_commit=True,
 			**email_args,
 		)
@@ -1115,11 +1130,6 @@ def get_print_format_list(ref_doctype: str):
 	return {"print_format": print_format_list}
 
 
-@frappe.whitelist()
-def resend_payment_email(docname: str):
-	return frappe.get_doc("Payment Request", docname).send_email()
-
-
 @frappe.whitelist()
 def make_payment_entry(docname: str):
 	doc = frappe.get_doc("Payment Request", docname)

erpnext/assets/doctype/asset_capitalization/asset_capitalization.py

@@ -539,11 +539,13 @@ def get_target_asset_details(asset: str | None = None, company: str | None = Non
 @frappe.whitelist()
 @erpnext.normalize_ctx_input(ItemDetailsCtx)
 def get_consumed_stock_item_details(ctx: ItemDetailsCtx):
+	frappe.has_permission("Stock Ledger Entry", throw=True)
 	out = frappe._dict()
 
 	item = frappe._dict()
 	if ctx.item_code:
 		item = frappe.get_cached_doc("Item", ctx.item_code)
+		item.check_permission()
 
 	out.item_name = item.item_name
 	out.batch_no = None
@@ -553,6 +555,8 @@ def get_consumed_stock_item_details(ctx: ItemDetailsCtx):
 	out.stock_uom = item.stock_uom
 
 	out.warehouse = get_item_warehouse_(ctx, item, overwrite_warehouse=True) if item else None
+	if out.warehouse:
+		frappe.has_permission("Warehouse", doc=out.warehouse, throw=True)
 
 	# Cost Center
 	item_defaults = get_item_defaults(item.name, ctx.company)
@@ -589,6 +593,9 @@ def get_consumed_stock_item_details(ctx: ItemDetailsCtx):
 def get_warehouse_details(ctx: ItemDetailsCtx) -> frappe._dict:
 	out = frappe._dict()
 	if ctx.warehouse and ctx.item_code:
+		frappe.has_permission("Item", doc=ctx.item_code, throw=True)
+		frappe.has_permission("Warehouse", doc=ctx.warehouse, throw=True)
+		frappe.has_permission("Stock Ledger Entry", throw=True)
 		out = frappe._dict(
 			{
 				"actual_qty": get_previous_sle(ctx).get("qty_after_transaction") or 0,

erpnext/controllers/item_variant.py

@@ -346,6 +346,7 @@ def create_variant(item: str, args: dict | str, use_template_image: bool = False
 def enqueue_multiple_variant_creation(item: str, args: dict | str, use_template_image: bool = False):
 	use_template_image = frappe.parse_json(use_template_image)
 	# There can be innumerable attribute combinations, enqueue
+	frappe.has_permission("Item", ptype="create", throw=True)
 	variants = frappe.parse_json(args)
 	variants = {key: values for key, values in variants.items() if values}
 	if not variants: